chore(deps): refresh the remaining lockfile packages and prune deny.toml skips (CW-8205)

cargo update moves 130 locked packages. Anything published within three days of the update stays at its previous version: rmcp 3.9.0 (3.10.0 is from 2026-11-12), rustls-webpki 0.103.16, webpki-root-certs 1.0.10, jiff, pest and its family, the rio and corcovado crates, annotate-snippets, errno, const-oid and webbrowser. Holding pest also keeps stacker, psm, object and ar_archive_writer out of the lock. The highest declared rust-version in the lock is still 1.89. cargo deny check bans: the reqwest, strum and strum_macros skips no longer match any crate and are removed, and the stale ratchet comment now lists only the duplicates that remain. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
chore(deps): update the TLS, HTTP/2 and crypto stack in the lockfile (CW-8205)
2026-11-12 18:18:10 -10:00 · 2026-11-12 19:55:01 -08:00 · 2026-11-12 18:34:12 -08:00 · 2026-11-12 18:32:24 -08:00
4 changed files with 501 additions and 451 deletions
@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ## [Unreleased]

+- **Dependencies:** updated the TLS, HTTP/2 and crypto libraries (h2 0.4.20, hyper 1.12.0, tokio 1.54.1, aws-lc-rs 1.19.0 with aws-lc-sys 0.47.0, rustls-native-certs 0.8.5 and rustls-platform-verifier 0.7.1) to their current patch releases.
+- **Windows clipboard:** Codewhale now uses clipboard-win 5.4.3 (with arboard 3.7.0) for copy and paste on Windows, replacing 5.4.1, which its author withdrew from crates.io.
 - **Renaming sessions with Chinese titles:** the session picker no longer rejects a Chinese, Japanese, Korean or emoji title of more than about 33 characters as "Title must be 1–100 characters". It now counts characters, as the message says and as `/rename` and the Runtime API already did, so any title up to 100 characters is accepted. Thanks [@luochen211](https://github.com/luochen211) (PR 7322).
 - **Non-ASCII file names:** `/diff`, the `@git` and `@diff` mentions and the Runtime API workspace diff now show paths with Chinese, emoji and other non-ASCII characters as written instead of as quoted octal escapes, and the turn context no longer lists the workspace root as an empty "Active paths" entry. Thanks [@luochen211](https://github.com/luochen211) (PR 7317).
 - **Session names after a crash, and keep-forever snapshot retention:** a session name saved right after a crash that cut off the previous session-index line is no longer lost, because the new entry now starts on its own line; and a very large `[snapshots] max_age_days` (such as `9223372036854775807` for "keep forever") no longer wraps around and deletes every undo snapshot at session start. Thanks [@luochen211](https://github.com/luochen211) (PR 7316).
@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ## [Unreleased]

+- **Dependencies:** updated the TLS, HTTP/2 and crypto libraries (h2 0.4.20, hyper 1.12.0, tokio 1.54.1, aws-lc-rs 1.19.0 with aws-lc-sys 0.47.0, rustls-native-certs 0.8.5 and rustls-platform-verifier 0.7.1) to their current patch releases.
+- **Windows clipboard:** Codewhale now uses clipboard-win 5.4.3 (with arboard 3.7.0) for copy and paste on Windows, replacing 5.4.1, which its author withdrew from crates.io.
 - **Renaming sessions with Chinese titles:** the session picker no longer rejects a Chinese, Japanese, Korean or emoji title of more than about 33 characters as "Title must be 1–100 characters". It now counts characters, as the message says and as `/rename` and the Runtime API already did, so any title up to 100 characters is accepted. Thanks [@luochen211](https://github.com/luochen211) (PR 7322).
 - **Non-ASCII file names:** `/diff`, the `@git` and `@diff` mentions and the Runtime API workspace diff now show paths with Chinese, emoji and other non-ASCII characters as written instead of as quoted octal escapes, and the turn context no longer lists the workspace root as an empty "Active paths" entry. Thanks [@luochen211](https://github.com/luochen211) (PR 7317).
 - **Session names after a crash, and keep-forever snapshot retention:** a session name saved right after a crash that cut off the previous session-index line is no longer lost, because the new entry now starts on its own line; and a very large `[snapshots] max_age_days` (such as `9223372036854775807` for "keep forever") no longer wraps around and deletes every undo snapshot at session start. Thanks [@luochen211](https://github.com/luochen211) (PR 7316).
@@ -16,25 +16,18 @@ ignore = [
 ]

 [bans]
-# Duplicate-version ratchet (Epic #5249, issue #5248): keep the gate in
-# warn/dry-run until Hunter approves enforcement. Each entry below is a
-# duplicate that survives the 0.9.5 shrink and is blocked on an upstream
-# crate that has not yet released a compatible version. Adding a new
-# duplicate without extending this list will surface as a new `cargo deny`
-# warning, so the ratchet is warm but not yet blocking CI.
-# Surviving duplicates after the 708 -> 679 shrink (see PR body):
-# - reqwest 0.12 vs 0.13 — blocked on oauth2 5.0.0 which still depends on reqwest 0.12
-# - sha2 0.10 vs 0.11 — blocked on oauth2 (0.10) vs schemaui 0.12 (0.11)
-# - thiserror 1 vs 2 — blocked on portable-pty 0.9 via filedescriptor 0.8 (v1) vs workspace v2
-# - toml 0.8 vs 1.1 + toml_edit 0.22 vs 0.25 + winnow 0.7 vs 1.0 — blocked on rust-i18n 4.2 (0.8 stack) vs workspace 1.1
-# - strum 0.27 vs 0.28 — ratatui-widgets 0.3.0 (via ratatui 0.30.0) pins 0.27
-#   while ratatui-core 0.1.2 uses 0.28; unifies once widgets moves forward
+# Duplicate versions warn without failing CI. Each skip below is a duplicate
+# that survives because an upstream crate has not released a compatible
+# version; a duplicate that is not listed surfaces as a new `cargo deny`
+# warning. Remove a skip when the warning "skip was not encountered" or
+# "applied to a crate with only one version" appears.
+# - sha2 0.10 vs 0.11: oauth2 (0.10) vs schemaui 0.12 (0.11)
+# - thiserror 1 vs 2: portable-pty 0.9 via filedescriptor 0.8 (v1) vs workspace v2
+# - toml 0.8 vs 1.x, toml_edit 0.22 vs 0.25, winnow 0.7 vs 1.0, serde_spanned 0.6
+#   vs 1.x: rust-i18n 4.2 (0.8 stack) vs workspace 1.x
 multiple-versions = "warn"
 wildcards = "deny"
-# Explicitly allow the surviving duplicates so `cargo deny` does not warn
-# on them again, but will warn on any *new* duplicate crate.
 skip = [
-    { name = "reqwest", version = "0.12.28" },
    { name = "sha2", version = "0.10.9" },
    { name = "thiserror", version = "1.0.69" },
    { name = "thiserror-impl", version = "1.0.69" },
@@ -46,8 +39,6 @@ skip = [
    { name = "core-foundation", version = "0.9.4" },
    { name = "itertools", version = "0.13.0" },
    { name = "security-framework", version = "2.11.1" },
-    { name = "strum", version = "0.28.0" },
-    { name = "strum_macros", version = "0.28.0" },
    # Pinned to the versions actually in Cargo.lock so a NEW duplicate in this
    # family is flagged instead of skipped silently.
    { name = "windows-sys", version = "0.52.0" },