build(deps): bump act-sdk from 0.6.0 to 0.8.2

[dependabot]

Bumps act-sdk from 0.6.0 to 0.8.2.

Changelog

Sourced from act-sdk's changelog.

[0.8.2] - 2026-06-15

Changed

• Bytes is now envelope-only. It serializes and deserializes strictly as a CBOR byte string — the {"$bytes":"<base64>"} envelope on JSON transports — and no longer accepts a bare base64 string (a string is text, not bytes). Its JSON Schema is now the $bytes object, and returning Bytes from a tool yields the envelope (use Content("image/png", …) for raw mime-typed blobs). One consistent rule now holds across all binary types: a bare string is always text; bytes always travel as an envelope.

[0.8.1] - 2026-06-15

Added

• Bytes type for binary tool fields — serializes to a CBOR byte string (major type 2), deserializes from either a byte string or a base64 string, and advertises contentEncoding: base64 in its JSON Schema. Returning Bytes produces application/octet-stream. Exported from the prelude.
• Lossless binary round-trip across JSON transports — CBOR byte strings now project to and from the canonical {"$bytes":"<base64>"} JSON wrapper (with $-prefixed key escaping), so binary data survives HTTP+JSON and MCP without base64-into-text corruption.

[0.8.0] - 2026-06-13

Changed

• Adopted the WASI 0.3 (final) toolchain. The SDK now builds against wit-bindgen 0.58, and the HTTP examples target wasip3 0.7.0 (the ratified wasi:0.3.0). Breaking: components built with the SDK must bump their own wit-bindgen dependency to 0.58.
• The tool-call macro now generates wit_bindgen::spawn_local (the function was renamed from spawn in wit-bindgen 0.58).

[0.7.1] - 2026-05-24

Added

• include! support in #[act_component]. #[act_tool] functions can now live in separate files and be pulled into the component module via include!("path"), so large components (e.g. 100+ tools) can be split across many modules instead of one giant lib.rs. Included paths resolve relative to src/.
• wasi:sockets capability declarations. SocketsCap now carries allow entries (host/CIDR + required ports + optional protocols, defaulting to TCP+UDP), declaring the capability ceiling for raw TCP/UDP I/O. Default protocols are omitted on serialization to keep manifest round-trips clean.

[0.7.0] - 2026-05-06

... (truncated)

Commits

• b0daf4c chore(release): 0.8.2
• bcf69c2 refactor(act-sdk)!: Bytes is envelope-only
• 1608a9c chore(release): 0.8.1
• 30bfcd0 feat(act-sdk): add Bytes type for native binary fields
• b9805ad feat(act-types): CBOR<->JSON byte-string round-trip via $bytes wrapper
• c434929 chore(release): 0.8.0
• 9bac4d1 feat(sdk)!: adopt WASI 0.3 final toolchain (wit-bindgen 0.58, wasip3 0.7.0)
• 8f04c63 chore(release): 0.7.1
• dab526a feat(macros): expand include! in #[act_component] for modular tool files
• 41740d8 fix(act-types): skip default protocols on SocketsAllow serialize
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	act-sdk@​0.6.0 ⏵ 0.8.2

View full report

[dependabot]

Superseded by #9.