Upgrade tantivy to 0.26 and clear the lru advisory

Dependabot #10: lru's IterMut violates Stacked Borrows, fixed in 0.16.3.
lru was transitive through tantivy 0.22.1, which pins lru ^0.12.0, so
there was no in-range fix -- cargo update -p lru locks nothing. The
advisory was also not reachable: tantivy calls only get, put, len,
peek_lru and new on its LruCache, never iter_mut. Upgrading rather than
dismissing because it is early enough that carrying four versions of
drift costs more than paying it now, and the alert then closes on its
own evidence rather than on an argument.

lru resolves to 0.16.4, past the patch line.

One API change across the four releases. TopDocs no longer implements
Collector on its own -- an ordering has to be chosen rather than
defaulted into. order_by_score() is exactly what bare TopDocs did in
0.22, so result order is preserved rather than quietly changed, which
matters for a search endpoint whose contract is "most relevant first".

Index compatibility checked rather than assumed, since a format change
would have meant a reindex for every existing deployment. Against a live
index of 1757 documents written by 0.22: the service opened it without
error, a document indexed hours earlier by 0.22 is still findable, new
documents written by 0.26 are findable, and a phrase query spans both.
No migration needed.

The compliance inventory is regenerated for the new graph: 17 crates
added, 5 gone, 20 bumped, and three duplicate-version entries collapsed
where the graph no longer needs two. Nothing newly flagged -- every
addition is permissive -- and cargo-deny check licenses, which is the
gate CI actually runs, passes. Rows for crates whose name and version
are unchanged are left byte-for-byte alone, so the diff shows the real
change rather than 200 rows of SPDX term reordering.

Signed-off-by: John Coffey <[email protected]>

docs/compliance/license-inventory.csv

@@ -509,6 +509,8 @@ search,base64,0.22.1,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,bitflags,2.13.1,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,bitpacking,0.9.3,MIT,transitive,rust,False,,a
 search,block-buffer,0.10.4,Apache-2.0 OR MIT,transitive,rust,False,,a
+search,bon,3.10.0,Apache-2.0 OR MIT,transitive,rust,False,,a
+search,bon-macros,3.10.0,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,bumpalo,3.20.3,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,byteorder,1.5.0,MIT OR Unlicense,transitive,rust,False,,a
 search,bytes,1.12.1,MIT,transitive,rust,False,,a
@@ -525,12 +527,17 @@ search,crossbeam-epoch,0.9.20,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,crossbeam-utils,0.8.22,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,crunchy,0.2.4,MIT,transitive,rust,False,,a
 search,crypto-common,0.1.7,Apache-2.0 OR MIT,transitive,rust,False,,a
+search,darling,0.24.1,MIT,transitive,rust,False,,a
+search,darling_core,0.24.1,MIT,transitive,rust,False,,a
+search,darling_macro,0.24.1,MIT,transitive,rust,False,,a
+search,datasketches,0.2.0,Apache-2.0,transitive,rust,False,,a
 search,deranged,0.5.8,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,digest,0.10.7,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,displaydoc,0.2.7,Apache-2.0 OR MIT,transitive,rust,False,,a
-search,downcast-rs,1.2.1,Apache-2.0 OR MIT,transitive,rust,False,,a
+search,downcast-rs,2.0.2,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,either,1.17.0,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,equivalent,1.0.2,Apache-2.0 OR MIT,transitive,rust,False,,a
+search,erased-serde,0.4.10,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,errno,0.3.14,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,fastdivide,0.4.2,MIT OR zlib-acknowledgement,transitive,rust,True,carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification,a
 search,fastrand,2.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a
@@ -538,9 +545,9 @@ search,find-msvc-tools,0.1.10,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,fixedbitset,0.5.7,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,flate2,1.1.9,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,fnv,1.0.7,Apache-2.0 OR MIT,transitive,rust,False,,a
-search,foldhash,0.1.5,Zlib,transitive,rust,False,,a
+search,foldhash,0.2.0,Zlib,transitive,rust,False,,a
 search,form_urlencoded,1.2.2,Apache-2.0 OR MIT,transitive,rust,False,,a
-search,fs4,0.8.4,Apache-2.0 OR MIT,transitive,rust,False,,a
+search,fs4,0.13.1,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,futures,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,futures-channel,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,futures-core,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
@@ -553,12 +560,11 @@ search,futures-util,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,generic-array,0.14.7,MIT,transitive,rust,False,,a
 search,getrandom,0.2.17,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,getrandom,0.4.3,Apache-2.0 OR MIT,transitive,rust,False,,a
-search,h2,0.4.15,MIT,transitive,rust,False,,a
+search,h2,0.4.16,MIT,transitive,rust,False,,a
 search,hashbrown,0.12.3,Apache-2.0 OR MIT,transitive,rust,False,,a
-search,hashbrown,0.15.5,Apache-2.0 OR MIT,transitive,rust,False,,a
+search,hashbrown,0.16.1,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,hashbrown,0.17.1,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,heck,0.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a
-search,hermit-abi,0.5.2,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,hmac,0.12.1,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,htmlescape,0.3.1,Apache-2.0 OR MIT OR MPL-2.0,transitive,rust,True,carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification,a
 search,http,1.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a
@@ -576,14 +582,14 @@ search,icu_normalizer_data,2.3.0,Unicode-3.0,transitive,rust,False,,a
 search,icu_properties,2.3.0,Unicode-3.0,transitive,rust,False,,a
 search,icu_properties_data,2.3.0,Unicode-3.0,transitive,rust,False,,a
 search,icu_provider,2.3.0,Unicode-3.0,transitive,rust,False,,a
+search,ident_case,1.0.1,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,idna,1.1.0,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,idna_adapter,1.2.2,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,indexmap,1.9.3,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,indexmap,2.14.0,Apache-2.0 OR MIT,transitive,rust,False,,a
-search,instant,0.1.13,BSD-3-Clause,transitive,rust,False,,a
 search,integer-encoding,4.1.0,MIT,transitive,rust,False,,a
+search,inventory,0.3.24,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,ipnet,2.12.1,Apache-2.0 OR MIT,transitive,rust,False,,a
-search,itertools,0.12.1,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,itertools,0.14.0,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,itoa,1.0.18,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,jobserver,0.1.35,Apache-2.0 OR MIT,transitive,rust,False,,a
@@ -591,19 +597,17 @@ search,js-sys,0.3.104,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,lazy_static,1.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,levenshtein_automata,0.2.1,MIT,transitive,rust,False,,a
 search,libc,0.2.189,Apache-2.0 OR MIT,transitive,rust,False,,a
-search,libm,0.2.16,MIT,transitive,rust,False,,a
 search,linux-raw-sys,0.12.1,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a
-search,linux-raw-sys,0.4.15,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a
 search,litemap,0.8.3,Unicode-3.0,transitive,rust,False,,a
 search,lock_api,0.4.14,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,log,0.4.33,Apache-2.0 OR MIT,transitive,rust,False,,a
-search,lru,0.12.5,MIT,transitive,rust,False,,a
+search,lru,0.16.4,MIT,transitive,rust,False,,a
 search,lz4,1.28.1,MIT,transitive,rust,False,,a
 search,lz4-sys,1.11.1+lz4-1.10.0,MIT,transitive,rust,False,,a
-search,lz4_flex,0.11.6,MIT,transitive,rust,False,,a
+search,lz4_flex,0.13.1,MIT,transitive,rust,False,,a
 search,matchers,0.2.0,MIT,transitive,rust,False,,a
 search,matchit,0.7.3,BSD-3-Clause OR MIT,transitive,rust,False,,a
-search,measure_time,0.8.3,MIT,transitive,rust,False,,a
+search,measure_time,0.9.0,MIT,transitive,rust,False,,a
 search,memchr,2.8.3,MIT OR Unlicense,transitive,rust,False,,a
 search,memmap2,0.9.11,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,mime,0.3.17,Apache-2.0 OR MIT,transitive,rust,False,,a
@@ -616,10 +620,10 @@ search,nom,7.1.3,MIT,transitive,rust,False,,a
 search,nu-ansi-term,0.50.3,MIT,transitive,rust,False,,a
 search,num-conv,0.2.2,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,num-traits,0.2.19,Apache-2.0 OR MIT,transitive,rust,False,,a
-search,num_cpus,1.17.0,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,once_cell,1.21.4,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,oneshot,0.1.13,Apache-2.0 OR MIT,transitive,rust,False,,a
-search,ownedbytes,0.7.0,MIT,transitive,rust,False,,a
+search,ordered-float,5.5.0,MIT,transitive,rust,False,,a
+search,ownedbytes,0.9.0,MIT,transitive,rust,False,,a
 search,parking_lot,0.12.5,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,parking_lot_core,0.9.12,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,pbkdf2,0.12.2,Apache-2.0 OR MIT,transitive,rust,False,,a
@@ -633,6 +637,7 @@ search,potential_utf,0.1.6,Unicode-3.0,transitive,rust,False,,a
 search,powerfmt,0.2.0,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,ppv-lite86,0.2.21,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,prettyplease,0.2.37,Apache-2.0 OR MIT,transitive,rust,False,,a
+search,prettyplease,0.3.0,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,proc-macro2,1.0.107,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,prost,0.13.5,Apache-2.0,direct,rust,False,,a
 search,prost-build,0.13.5,Apache-2.0,transitive,rust,False,,a
@@ -643,7 +648,6 @@ search,r-efi,6.0.0,Apache-2.0 OR LGPL-2.1-or-later OR MIT,transitive,rust,True,c
 search,rand,0.8.7,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,rand_chacha,0.3.1,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,rand_core,0.6.4,Apache-2.0 OR MIT,transitive,rust,False,,a
-search,rand_distr,0.4.3,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,rayon,1.12.0,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,rayon-core,1.13.0,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,redox_syscall,0.5.18,MIT,transitive,rust,False,,a
@@ -654,9 +658,8 @@ search,reqwest,0.12.28,Apache-2.0 OR MIT,direct,rust,False,,a
 search,rsasl,2.3.1,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,rskafka,0.6.0,Apache-2.0 OR MIT,direct,rust,False,,a
 search,rust-stemmers,1.2.0,BSD-3-Clause OR MIT,transitive,rust,False,,a
-search,rustc-hash,1.1.0,Apache-2.0 OR MIT,transitive,rust,False,,a
+search,rustc-hash,2.1.3,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,rustc_version,0.4.1,Apache-2.0 OR MIT,transitive,rust,False,,a
-search,rustix,0.38.44,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a
 search,rustix,1.1.4,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a
 search,rustversion,1.0.23,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,ryu,1.0.23,Apache-2.0 OR BSL-1.0,transitive,rust,True,carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification,a
@@ -672,7 +675,7 @@ search,sharded-slab,0.1.7,MIT,transitive,rust,False,,a
 search,shlex,2.0.1,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,signal-hook-registry,1.4.8,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,simd-adler32,0.3.10,MIT,transitive,rust,False,,a
-search,sketches-ddsketch,0.2.2,Apache-2.0,transitive,rust,False,,a
+search,sketches-ddsketch,0.4.1,Apache-2.0,transitive,rust,False,,a
 search,slab,0.4.12,MIT,transitive,rust,False,,a
 search,smallvec,1.15.2,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,snap,1.1.2,BSD-3-Clause,transitive,rust,False,,a
@@ -680,20 +683,21 @@ search,socket2,0.5.10,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,socket2,0.6.5,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,stable_deref_trait,1.2.1,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,stringprep,0.1.5,Apache-2.0 OR MIT,transitive,rust,False,,a
+search,strsim,0.11.1,MIT,transitive,rust,False,,a
 search,subtle,2.6.1,BSD-3-Clause,transitive,rust,False,,a
 search,syn,2.0.119,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,syn,3.0.3,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,sync_wrapper,1.0.2,Apache-2.0,transitive,rust,False,,a
 search,synstructure,0.13.2,MIT,transitive,rust,False,,a
-search,tantivy,0.22.1,MIT,direct,rust,False,,a
+search,tantivy,0.26.1,MIT,direct,rust,False,,a
-search,tantivy-bitpacker,0.6.0,MIT,transitive,rust,False,,a
+search,tantivy-bitpacker,0.10.0,MIT,transitive,rust,False,,a
-search,tantivy-columnar,0.3.0,MIT,transitive,rust,False,,a
+search,tantivy-columnar,0.7.0,MIT,transitive,rust,False,,a
-search,tantivy-common,0.7.0,MIT,transitive,rust,False,,a
+search,tantivy-common,0.11.0,MIT,transitive,rust,False,,a
 search,tantivy-fst,0.5.0,MIT OR Unlicense,transitive,rust,False,,a
-search,tantivy-query-grammar,0.22.0,MIT,transitive,rust,False,,a
+search,tantivy-query-grammar,0.26.0,MIT,transitive,rust,False,,a
-search,tantivy-sstable,0.3.0,MIT,transitive,rust,False,,a
+search,tantivy-sstable,0.7.0,MIT,transitive,rust,False,,a
-search,tantivy-stacker,0.3.0,MIT,transitive,rust,False,,a
+search,tantivy-stacker,0.7.0,MIT,transitive,rust,False,,a
-search,tantivy-tokenizer-api,0.3.0,MIT,transitive,rust,False,,a
+search,tantivy-tokenizer-api,0.7.0,MIT,transitive,rust,False,,a
 search,tempfile,3.27.0,Apache-2.0 OR MIT,direct,rust,False,,a
 search,thiserror,1.0.69,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,thiserror,2.0.20,Apache-2.0 OR MIT,transitive,rust,False,,a
@@ -702,6 +706,7 @@ search,thiserror-impl,2.0.20,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,thread_local,1.1.10,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,time,0.3.55,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,time-core,0.1.9,Apache-2.0 OR MIT,transitive,rust,False,,a
+search,time-macros,0.2.32,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,tinystr,0.8.4,Unicode-3.0,transitive,rust,False,,a
 search,tinyvec,1.12.0,Apache-2.0 OR MIT OR Zlib,transitive,rust,False,,a
 search,tinyvec_macros,0.1.1,Apache-2.0 OR MIT OR Zlib,transitive,rust,False,,a
@@ -722,7 +727,10 @@ search,tracing-core,0.1.36,MIT,transitive,rust,False,,a
 search,tracing-log,0.2.0,MIT,transitive,rust,False,,a
 search,tracing-subscriber,0.3.23,MIT,direct,rust,False,,a
 search,try-lock,0.2.5,MIT,transitive,rust,False,,a
+search,typeid,1.0.3,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,typenum,1.20.1,Apache-2.0 OR MIT,transitive,rust,False,,a
+search,typetag,0.2.23,Apache-2.0 OR MIT,transitive,rust,False,,a
+search,typetag-impl,0.2.23,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,unicode-bidi,0.3.18,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,unicode-ident,1.0.24,Apache-2.0 OR MIT OR Unicode-3.0,transitive,rust,False,,a
 search,unicode-normalization,0.1.25,Apache-2.0 OR MIT,transitive,rust,False,,a
@@ -731,6 +739,7 @@ search,url,2.5.8,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,utf8-ranges,1.0.5,MIT OR Unlicense,transitive,rust,False,,a
 search,utf8_iter,1.0.4,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,uuid,1.24.0,Apache-2.0 OR MIT,transitive,rust,False,,a
+search,valuable,0.1.1,MIT,transitive,rust,False,,a
 search,version_check,0.9.5,Apache-2.0 OR MIT,transitive,rust,False,,a
 search,want,0.3.1,MIT,transitive,rust,False,,a
 search,wasi,0.11.1+wasi-snapshot-preview1,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a
@@ -760,6 +769,7 @@ search,writeable,0.6.4,Unicode-3.0,transitive,rust,False,,a
 search,yoke,0.8.3,Unicode-3.0,transitive,rust,False,,a
 search,yoke-derive,0.8.2,Unicode-3.0,transitive,rust,False,,a
 search,zerocopy,0.8.56,Apache-2.0 OR BSD-2-Clause OR MIT,transitive,rust,False,,a
+search,zerocopy-derive,0.8.56,Apache-2.0 OR BSD-2-Clause OR MIT,transitive,rust,False,,a
 search,zerofrom,0.1.8,Unicode-3.0,transitive,rust,False,,a
 search,zerofrom-derive,0.1.7,Unicode-3.0,transitive,rust,False,,a
 search,zerotrie,0.2.5,Unicode-3.0,transitive,rust,False,,a
@@ -772,6 +782,6 @@ search,zstd-sys,2.0.16+zstd.1.5.7,Apache-2.0 OR MIT,transitive,rust,False,,a
 web,Overpass (font),variable,OFL-1.1,direct,font-asset,False,,a
 web,Overpass Mono (font),variable,OFL-1.1,direct,font-asset,False,,a
 web,favicon.svg,n/a,MIT (Svelte project asset),direct,vendored-asset,True,"Copied from SvelteKit's default project scaffold (<title>svelte-logo</title>), never replaced with an original mark -- not a license-compatibility blocker (Svelte's own assets are MIT) but is unauthored, unattributed, third-party branded content shipping as this product's own favicon. Flagged for replacement, not a legal blocker.",n/a-branding
-transport,redpanda (docker image),v24.2.7,"BSL 1.1 (Business Source License) for Redpanda Core, as pinned (v24.2.7, released 2024-10-11) -- NOT yet converted to Apache-2.0 (4-year Change Date is ~2028-10-11). Source-available, not OSI-approved open source. Additional Use Grant permits any use except offering it as a hosted 'Streaming or Queuing Service' to third parties.",direct,docker-image,True,"Category (c): BSL is explicitly source-available, not OSI-approved open source, per the audit's own classification framework. Verified against the actual licenses/bsl.md at the v24.2.7 tag, not assumed. No AGPL linking-compatibility issue (Redpanda is consumed only over the Kafka wire protocol, never linked into Sentry's own code -- same relationship as ClickHouse/Postgres). Real open question: whether a third party self-hosting Sentry (now fully AGPLv3 per task 6) 'as a service' would trip BSL's Streaming-or-Queuing-Service restriction on the bundled Redpanda image -- Sentry's ingest pipeline creates fixed internal topics, not per-end-user topics, so this is very likely NOT a Streaming-or-Queuing-Service under BSL's own definition, but this is a business/redistribution judgment call, not a pure technical one -- flagged for your decision, not resolved unilaterally. See license-audit-report.md's Redpanda section for the three remediation options (accept as-is / swap to Apache Kafka / flag only). RESOLVED 2026-08-16 (business decision): accept as-is. Sentry's own use (internal Kafka-protocol transport, no resale of broker access) is within BSL's Additional Use Grant; the third-party self-hosting-as-a-service question was judged unlikely to trip BSL's Streaming-or-Queuing-Service restriction, and was accepted as a known, disclosed risk rather than swapping to a heavier broker or dropping the bundled image. See license-audit-report.md's Redpanda section.",c
+transport,redpanda (docker image),v24.2.7,"BSL 1.1 (Business Source License) for Redpanda Core, as pinned (v24.2.7, released 2024-10-11) -- NOT yet converted to Apache-2.0 (4-year Change Date is ~2028-10-11). Source-available, not OSI-approved open source. Additional Use Grant permits any use except offering it as a hosted 'Streaming or Queuing Service' to third parties.",direct,docker-image,True,"Category (c): BSL is explicitly source-available, not OSI-approved open source, per the audit's own classification framework. Verified against the actual licenses/bsl.md at the v24.2.7 tag, not assumed. No AGPL linking-compatibility issue (Redpanda is consumed only over the Kafka wire protocol, never linked into Cairn OBS's own code -- same relationship as ClickHouse/Postgres). Real open question: whether a third party self-hosting Cairn OBS (now fully AGPLv3 per task 6) 'as a service' would trip BSL's Streaming-or-Queuing-Service restriction on the bundled Redpanda image -- Cairn OBS's ingest pipeline creates fixed internal topics, not per-end-user topics, so this is very likely NOT a Streaming-or-Queuing-Service under BSL's own definition, but this is a business/redistribution judgment call, not a pure technical one -- flagged for your decision, not resolved unilaterally. See license-audit-report.md's Redpanda section for the three remediation options (accept as-is / swap to Apache Kafka / flag only). RESOLVED 2026-08-16 (business decision): accept as-is. Cairn OBS's own use (internal Kafka-protocol transport, no resale of broker access) is within BSL's Additional Use Grant; the third-party self-hosting-as-a-service question was judged unlikely to trip BSL's Streaming-or-Queuing-Service restriction, and was accepted as a known, disclosed risk rather than swapping to a heavier broker or dropping the bundled image. See license-audit-report.md's Redpanda section.",c
 storage,clickhouse-server (docker image),24.8,"Apache-2.0, confirmed directly against ClickHouse's LICENSE file. No evidence of any historical license change (unlike Redpanda/Elastic/MongoDB) -- confirmed via web search plus direct file fetch, not assumed from general reputation.",direct,docker-image,False,,a
 metadata,postgres (docker image),16-alpine,"PostgreSQL License (OSI-approved, MIT/BSD-equivalent permissive terms), confirmed directly against the official postgres/postgres COPYRIGHT file.",direct,docker-image,False,,a

search/Cargo.lock

@@ -160,6 +160,29 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "bon"
+version = "3.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e3fac94a66da67200398458a25412bcc3f9b6443b5119a6cad9cf3ccfcd8cc6"
+dependencies = [
+ "bon-macros",
+]
+
+[[package]]
+name = "bon-macros"
+version = "3.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4654961ad0494e4774c5c60b4cb4cd0ae9b9d92d039d901638b1dba97ebebf5"
+dependencies = [
+ "darling",
+ "ident_case",
+ "prettyplease 0.3.0",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.20.3"
@@ -307,6 +330,46 @@ dependencies = [
  "typenum",
 ]
 
+[[package]]
+name = "darling"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed17f5901b6630b993ca003def43f2f8ef4014fc13b047b57aad617ff32bc2ec"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6837e2cf7485aaae18f86181d2f0e9a7ed297a025e220aeabf63fdebd3a2ddff"
+dependencies = [
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ac7135c3ef02b2f7833bbeb1be5ba7f966dcde8a87c6b87f65a778d71a02785"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "datasketches"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c286de4e81ea2590afc24d754e0f83810c566f50a1388fa75ebd57928c0d9745"
+
 [[package]]
 name = "deranged"
 version = "0.5.8"
@@ -340,9 +403,9 @@ dependencies = [
 
 [[package]]
 name = "downcast-rs"
-version = "1.2.1"
+version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"
+checksum = "117240f60069e65410b3ae1bb213295bd828f707b5bec6596a1afc8793ce0cbc"
 
 [[package]]
 name = "either"
@@ -356,6 +419,17 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
+[[package]]
+name = "erased-serde"
+version = "0.4.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2add8a07dd6a8d93ff627029c51de145e12686fbc36ecb298ac22e74cf02dec"
+dependencies = [
+ "serde",
+ "serde_core",
+ "typeid",
+]
+
 [[package]]
 name = "errno"
 version = "0.3.14"
@@ -363,7 +437,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -408,9 +482,9 @@ checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
 [[package]]
 name = "foldhash"
-version = "0.1.5"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
 [[package]]
 name = "form_urlencoded"
@@ -423,12 +497,12 @@ dependencies = [
 
 [[package]]
 name = "fs4"
-version = "0.8.4"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7e180ac76c23b45e767bd7ae9579bc0bb458618c4bc71835926e098e61d15f8"
+checksum = "8640e34b88f7652208ce9e88b1a37a2ae95227d84abec377ccd3c5cfeb141ed4"
 dependencies = [
- "rustix 0.38.44",
+ "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -578,9 +652,9 @@ checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
 [[package]]
 name = "hashbrown"
-version = "0.15.5"
+version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 dependencies = [
  "allocator-api2",
  "equivalent",
@@ -599,12 +673,6 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
-[[package]]
-name = "hermit-abi"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
-
 [[package]]
 name = "hmac"
 version = "0.12.1"
@@ -717,7 +785,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.5.10",
+ "socket2 0.6.5",
  "tokio",
  "tower-service",
  "tracing",
@@ -806,6 +874,12 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
 [[package]]
 name = "idna"
 version = "1.1.0"
@@ -847,39 +921,27 @@ dependencies = [
  "hashbrown 0.17.1",
 ]
 
-[[package]]
-name = "instant"
-version = "0.1.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222"
-dependencies = [
- "cfg-if",
- "js-sys",
- "wasm-bindgen",
- "web-sys",
-]
-
 [[package]]
 name = "integer-encoding"
 version = "4.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "14c00403deb17c3221a1fe4fb571b9ed0370b3dcd116553c77fa294a3d918699"
 
+[[package]]
+name = "inventory"
+version = "0.3.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4f0c30c76f2f4ccee3fe55a2435f691ca00c0e4bd87abe4f4a851b1d4dac39b"
+dependencies = [
+ "rustversion",
+]
+
 [[package]]
 name = "ipnet"
 version = "2.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a756c3fac73139e83f14c2d742155dd2b78d3ee56597b419a0579b7bdd6dd78"
 
-[[package]]
-name = "itertools"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
-dependencies = [
- "either",
-]
-
 [[package]]
 name = "itertools"
 version = "0.14.0"
@@ -934,18 +996,6 @@ version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 
-[[package]]
-name = "libm"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.4.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
-
 [[package]]
 name = "linux-raw-sys"
 version = "0.12.1"
@@ -975,11 +1025,11 @@ checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 
 [[package]]
 name = "lru"
-version = "0.12.5"
+version = "0.16.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "234cf4f4a04dc1f57e24b96cc0cd600cf2af460d4161ac5ecdd0af8e1f3b2a38"
+checksum = "7f66e8d5d03f609abc3a39e6f08e4164ebf1447a732906d39eb9b99b7919ef39"
 dependencies = [
- "hashbrown 0.15.5",
+ "hashbrown 0.16.1",
 ]
 
 [[package]]
@@ -1003,9 +1053,9 @@ dependencies = [
 
 [[package]]
 name = "lz4_flex"
-version = "0.11.6"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "373f5eceeeab7925e0c1098212f2fbc4d416adec9d35051a6ab251e824c1854a"
+checksum = "7ef0d4ed8669f8f8826eb00dc878084aa8f253506c4fd5e8f58f5bce72ddb97e"
 
 [[package]]
 name = "matchers"
@@ -1024,11 +1074,10 @@ checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
 
 [[package]]
 name = "measure_time"
-version = "0.8.3"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbefd235b0aadd181626f281e1d684e116972988c14c264e42069d5e8a5775cc"
+checksum = "51c55d61e72fc3ab704396c5fa16f4c184db37978ae4e94ca8959693a235fc0e"
 dependencies = [
- "instant",
  "log",
 ]
 
@@ -1108,7 +1157,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1124,17 +1173,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
 dependencies = [
  "autocfg",
- "libm",
-]
-
-[[package]]
-name = "num_cpus"
-version = "1.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91df4bbde75afed763b708b7eee1e8e7651e02d97f6d5dd763e89367e957b23b"
-dependencies = [
- "hermit-abi",
- "libc",
 ]
 
 [[package]]
@@ -1150,10 +1188,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "269bca4c2591a28585d6bf10d9ed0332b7d76900a1b02bec41bdc3a2cdcda107"
 
 [[package]]
-name = "ownedbytes"
+name = "ordered-float"
-version = "0.7.0"
+version = "5.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3a059efb063b8f425b948e042e6b9bd85edfe60e913630ed727b23e2dfcc558"
+checksum = "8c7c9e0d9b23589f26070720bac724174bfec1083e82f7854cdd0267518343c0"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "ownedbytes"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2fbd56f7631767e61784dc43f8580f403f4475bd4aaa4da003e6295e1bab4a7e"
 dependencies = [
  "stable_deref_trait",
 ]
@@ -1272,6 +1319,16 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "prettyplease"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bfe0f4c752e450fc2faf62654f1c134747922825d5b04ca717b8874f41a40c0"
+dependencies = [
+ "proc-macro2",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.107"
@@ -1298,12 +1355,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
 dependencies = [
  "heck",
- "itertools 0.14.0",
+ "itertools",
  "log",
  "multimap",
  "once_cell",
  "petgraph",
- "prettyplease",
+ "prettyplease 0.2.37",
  "prost",
  "prost-types",
  "regex",
@@ -1318,7 +1375,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
 dependencies = [
  "anyhow",
- "itertools 0.14.0",
+ "itertools",
  "proc-macro2",
  "quote",
  "syn 2.0.119",
@@ -1378,16 +1435,6 @@ dependencies = [
  "getrandom 0.2.17",
 ]
 
-[[package]]
-name = "rand_distr"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32cb0b9bc82b0a0876c2dd994a7e7a2683d3e7390ca40e6886785ef0c7e3ee31"
-dependencies = [
- "num-traits",
- "rand",
-]
-
 [[package]]
 name = "rayon"
 version = "1.12.0"
@@ -1531,9 +1578,9 @@ dependencies = [
 
 [[package]]
 name = "rustc-hash"
-version = "1.1.0"
+version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
 
 [[package]]
 name = "rustc_version"
@@ -1544,19 +1591,6 @@ dependencies = [
  "semver",
 ]
 
-[[package]]
-name = "rustix"
-version = "0.38.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
-dependencies = [
- "bitflags",
- "errno",
- "libc",
- "linux-raw-sys 0.4.15",
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "rustix"
 version = "1.1.4"
@@ -1566,8 +1600,8 @@ dependencies = [
  "bitflags",
  "errno",
  "libc",
- "linux-raw-sys 0.12.1",
+ "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1693,9 +1727,9 @@ checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
 
 [[package]]
 name = "sketches-ddsketch"
-version = "0.2.2"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85636c14b73d81f541e525f585c0a2109e6744e1565b5c1668e31c70c10ed65c"
+checksum = "513c3f5f732bfd6fbb187619c2dfe9d2f25f1a2976f01d575f0fd329d565df56"
 dependencies = [
  "serde",
 ]
@@ -1755,6 +1789,12 @@ dependencies = [
  "unicode-properties",
 ]
 
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
 [[package]]
 name = "subtle"
 version = "2.6.1"
@@ -1805,31 +1845,32 @@ dependencies = [
 
 [[package]]
 name = "tantivy"
-version = "0.22.1"
+version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96599ea6fccd844fc833fed21d2eecac2e6a7c1afd9e044057391d78b1feb141"
+checksum = "edde6a10743fff00a4e1a8c9ef020bf5f3cbad301b7d2d39f2b07f123c4eac07"
 dependencies = [
  "aho-corasick",
  "arc-swap",
  "base64",
  "bitpacking",
+ "bon",
  "byteorder",
  "census",
  "crc32fast",
  "crossbeam-channel",
+ "datasketches",
  "downcast-rs",
  "fastdivide",
  "fnv",
  "fs4",
  "htmlescape",
- "itertools 0.12.1",
+ "itertools",
  "levenshtein_automata",
  "log",
  "lru",
  "lz4_flex",
  "measure_time",
  "memmap2",
- "num_cpus",
  "once_cell",
  "oneshot",
  "rayon",
@@ -1848,30 +1889,31 @@ dependencies = [
  "tantivy-stacker",
  "tantivy-tokenizer-api",
  "tempfile",
- "thiserror 1.0.69",
+ "thiserror 2.0.20",
  "time",
+ "typetag",
  "uuid",
  "winapi",
 ]
 
 [[package]]
 name = "tantivy-bitpacker"
-version = "0.6.0"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "284899c2325d6832203ac6ff5891b297fc5239c3dc754c5bc1977855b23c10df"
+checksum = "4fed3d674429bcd2de5d0a6d1aa5495fed8afd9c5ecce993019caf7615f53fa4"
 dependencies = [
  "bitpacking",
 ]
 
 [[package]]
 name = "tantivy-columnar"
-version = "0.3.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12722224ffbe346c7fec3275c699e508fd0d4710e629e933d5736ec524a1f44e"
+checksum = "c57166f5bcfd478f370ab8445afb4678dce44801fa5ce5c451aaf8595583c5dc"
 dependencies = [
  "downcast-rs",
  "fastdivide",
- "itertools 0.12.1",
+ "itertools",
  "serde",
  "tantivy-bitpacker",
  "tantivy-common",
@@ -1881,9 +1923,9 @@ dependencies = [
 
 [[package]]
 name = "tantivy-common"
-version = "0.7.0"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8019e3cabcfd20a1380b491e13ff42f57bb38bf97c3d5fa5c07e50816e0621f4"
+checksum = "bbf10915aa75da3c3b0d58b58853d2e889efbaf32d4982a4c3715dde6bba23e5"
 dependencies = [
  "async-trait",
  "byteorder",
@@ -1905,19 +1947,25 @@ dependencies = [
 
 [[package]]
 name = "tantivy-query-grammar"
-version = "0.22.0"
+version = "0.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "847434d4af57b32e309f4ab1b4f1707a6c566656264caa427ff4285c4d9d0b82"
+checksum = "dfadb8526b6da90704feb293b0701a6aae62ea14983143344be2dc5ce30f1d82"
 dependencies = [
+ "fnv",
  "nom",
+ "ordered-float",
+ "serde",
+ "serde_json",
 ]
 
 [[package]]
 name = "tantivy-sstable"
-version = "0.3.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c69578242e8e9fc989119f522ba5b49a38ac20f576fc778035b96cc94f41f98e"
+checksum = "8a2cfc3ac5164cbadc28965ffb145a8f47582a60ae5897859ad8d4316596c606"
 dependencies = [
+ "futures-util",
+ "itertools",
  "tantivy-bitpacker",
  "tantivy-common",
  "tantivy-fst",
@@ -1926,20 +1974,19 @@ dependencies = [
 
 [[package]]
 name = "tantivy-stacker"
-version = "0.3.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c56d6ff5591fc332739b3ce7035b57995a3ce29a93ffd6012660e0949c956ea8"
+checksum = "6cbb051742da9d53ca9e8fff43a9b10e319338b24e2c0e15d0372df19ffeb951"
 dependencies = [
  "murmurhash32",
- "rand_distr",
  "tantivy-common",
 ]
 
 [[package]]
 name = "tantivy-tokenizer-api"
-version = "0.3.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a0dcade25819a89cfe6f17d932c9cedff11989936bf6dd4f336d50392053b04"
+checksum = "eac258c2c6390673f2685813afeeafcb8c4e0ee7de8dd3fc46838dcc37263f98"
 dependencies = [
  "serde",
 ]
@@ -1953,8 +2000,8 @@ dependencies = [
  "fastrand",
  "getrandom 0.4.3",
  "once_cell",
- "rustix 1.1.4",
+ "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2149,7 +2196,7 @@ version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9557ce109ea773b399c9b9e5dca39294110b74f1f342cb347a80d1fce8c26a11"
 dependencies = [
- "prettyplease",
+ "prettyplease 0.2.37",
  "proc-macro2",
  "prost-build",
  "prost-types",
@@ -2289,12 +2336,42 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
+[[package]]
+name = "typeid"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
+
 [[package]]
 name = "typenum"
 version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
+[[package]]
+name = "typetag"
+version = "0.2.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c90e86058a30d42a1a928dfb4b49bb33c98c3a2b4909492e6b0881cd94798ec2"
+dependencies = [
+ "erased-serde",
+ "inventory",
+ "once_cell",
+ "serde",
+ "typetag-impl",
+]
+
+[[package]]
+name = "typetag-impl"
+version = "0.2.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f153acc4e99a5f2a5aefa09fb078be54e26271b2813f6041200b224c098d8328"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "unicode-bidi"
 version = "0.3.18"

search/Cargo.toml

@@ -14,7 +14,7 @@ tokio = { version = "1", features = ["rt-multi-thread", "macros", "fs", "sync",
 tonic = "0.12"
 prost = "0.13"
 
-tantivy = "0.22"
+tantivy = "0.26"
 rskafka = "0.6"
 
 serde = { version = "1", features = ["derive"] }

search/src/index.rs

@@ -99,8 +99,13 @@ impl SearchIndex {
         let parsed_query = query_parser
             .parse_query(query)
             .context("parsing search query")?;
+        // tantivy 0.26 made the ordering explicit: TopDocs on its own no
+        // longer implements Collector, so a sort has to be chosen rather
+        // than defaulted into. order_by_score() is what 0.22's bare
+        // TopDocs did, so this preserves "most-relevant first" exactly
+        // rather than quietly changing result order.
         let top_docs = searcher
-            .search(&parsed_query, &TopDocs::with_limit(limit))
+            .search(&parsed_query, &TopDocs::with_limit(limit).order_by_score())
             .context("executing search")?;
 
         let mut ids = Vec::with_capacity(top_docs.len());