chore(deps): bump act-sdk from 0.6.0 to 0.11.0

[dependabot]

Bumps act-sdk from 0.6.0 to 0.11.0.

Changelog

Sourced from act-sdk's changelog.

[0.11.0] - 2026-06-22

Added

• Typed filesystem mounts. Components can declare bind/root mounts under params.mounts; Capabilities::fs_mounts() parses them into typed entries, and a new validate_mounts() helper checks them at build time.

[0.10.0] - 2026-06-18

This release replaces the per-class capability types with a single uniform model.

Changed

• Uniform capability model (breaking). The per-class structs (FilesystemCap/HttpCap/SocketsCap) are replaced by one CapabilityRequest + provider-defined Constraint envelope, keyed by capability id. Capabilities now serializes as a map keyed by id.

Fixed

• LocalizedString now serializes untagged (a bare string or a map) instead of {"Plain": "…"}.

Removed

• Dropped the unused CapabilityRequest.optional field (YAGNI).

[0.9.0] - 2026-06-16

This release moves component metadata out of the SDK macros into act-build pack. Components run act-build pack after cargo build (the canonical flow) — a bare cargo build no longer embeds act:component. pack resolves metadata from the language project declaration (Cargo.toml [package], pyproject.toml, package.json) merged with act.toml.

Changed

• #[act_component] is lean and takes no arguments. It compiles only component logic (WIT world, list_tools/call_tool dispatch, session-provider). It no longer reads the project manifest or embeds the act:component / version / description sections — act-build pack is now the sole metadata embedder, resolving name/version/description from the language project declaration (Cargo.toml [package], preferred), merged with act.toml, with act-build pack --set std.name=… for feature-conditional overrides.
• Tool return encoding unified behind IntoToolResponse (renamed from IntoResponse), resolved by autoref specialization: String/&str→text/plain, Vec<u8>→application/octet-stream, Content→its MIME, Json<T>→ application/json, any other Serialize value (incl. Bytes)→application/cbor. No behavior change for components.

... (truncated)

Commits

• 84cad1c chore(release): 0.11.0
• a942c17 test(act-types): assert type serialization; cover bind-without-guest; tighten...
• fa38b57 feat(act-types): add validate_mounts helper
• d4f7ddd feat(act-types): add typed filesystem mounts (bind/root) + fs_mounts()
• a69aa96 refactor(act-types)!: drop unused CapabilityRequest.optional (YAGNI)
• 2fce20a chore(act-sdk-rs)!: bump to 0.10.0 for uniform capability model
• a6a7b28 feat(act-types)!: replace typed Capabilities with uniform map; drop legacy ca...
• 8ec890d fix(act-types): serialize LocalizedString untagged (plain-string-or-map)
• 83e24b4 feat(act-types): add uniform CapabilityRequest/Constraint (additive)
• 9429bf1 chore(release): 0.9.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	serde_json@​1.0.149 ⏵ 1.0.150
	act-sdk@​0.6.0 ⏵ 0.11.0

View full report

[dependabot]

Looks like act-sdk is up-to-date now, so this is no longer needed.