Update all non-major dependencies

Cargo.toml

@@ -55,7 +55,7 @@ serde       = { version = "1", features = ["derive"] }
 serde_json  = "1"
 serde_yaml  = "0.9"
 evalexpr    = "11"
-cron        = "0.12"
+cron        = "0.16"
 # Observability
 tracing             = "0.1"
 tracing-subscriber  = { version = "0.3", features = ["env-filter", "json"] }
@@ -71,15 +71,15 @@ uuid    = { version = "1", features = ["v4", "serde"] }
 chrono  = { version = "0.4", features = ["serde"] }
 
 # HTTP client (webhook delivery, Typesense indexing)
-reqwest = { version = "0.12", features = ["json", "rustls-tls"], default-features = false }
+reqwest = { version = "0.13", features = ["json", "rustls"], default-features = false }
 
 # Cryptography
-sha2      = "0.10"
+sha2      = "0.11"
 hex       = "0.4"
-hmac      = "0.12"
+hmac      = "0.13"
 
 # Randomness
-rand = "0.8"
+rand = "0.10"
 
 # Concurrent data structures
 dashmap = "6"
@@ -93,7 +93,7 @@ jsonwebtoken = "9"
 futures-util = "0.3"
 
 # WebSocket client (test client)
-tokio-tungstenite = { version = "0.26", features = ["rustls-tls-webpki-roots"] }
+tokio-tungstenite = { version = "0.29", features = ["rustls-tls-webpki-roots"] }
 url = "2"
 
 # MCP SDK

Dockerfile

@@ -1,6 +1,6 @@
 # ── Build stage ──────────────────────────────────────────────
 # Hard-code --platform to prevent exec format error on ARM Macs.
-FROM --platform=linux/amd64 rust:1.88-bookworm AS builder
+FROM --platform=linux/amd64 rust:1.93-bookworm AS builder
 WORKDIR /build
 COPY . .
 RUN cargo build --release -p sprout-relay \

crates/sprout-acp/Cargo.toml

@@ -59,7 +59,7 @@ anyhow = { workspace = true }
 clap = { version = "4", features = ["derive", "env"] }
 
 # Config file
-toml = "0.8"
+toml = "0.9"
 
 # Filter expressions
 evalexpr = { workspace = true }

crates/sprout-auth/src/nip42.rs

@@ -36,8 +36,7 @@ const TIMESTAMP_TOLERANCE_SECS: u64 = 60;
 
 /// Generate a random NIP-42 challenge (32 CSPRNG bytes, hex-encoded).
 pub fn generate_challenge() -> String {
-    use rand::Rng;
-    let bytes: [u8; 32] = rand::thread_rng().gen();
+    let bytes: [u8; 32] = rand::random();
     hex::encode(bytes)
 }
 

crates/sprout-auth/src/token.rs

@@ -10,8 +10,7 @@ const TOKEN_PREFIX: &str = "sprout_";
 
 /// Generate a new random API token (CSPRNG, 32 bytes, hex-encoded with prefix).
 pub fn generate_token() -> String {
-    use rand::Rng;
-    let bytes: [u8; 32] = rand::thread_rng().gen();
+    let bytes: [u8; 32] = rand::random();
     format!("{}{}", TOKEN_PREFIX, hex::encode(bytes))
 }
 

crates/sprout-cli/Cargo.toml

@@ -41,4 +41,4 @@ sprout-sdk = { workspace = true }
 base64 = "0.22"
 
 # SHA-256 — NIP-98 payload hash tag
-sha2 = "0.10"
+sha2 = "0.11"

crates/sprout-huddle/src/webhook.rs

@@ -1,4 +1,4 @@
-use hmac::{Hmac, Mac};
+use hmac::{Hmac, KeyInit, Mac};
 use serde::{Deserialize, Serialize};
 use sha2::Sha256;
 
@@ -155,7 +155,7 @@ pub fn parse_webhook(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use hmac::{Hmac, Mac};
+    use hmac::{Hmac, KeyInit, Mac};
     use sha2::Sha256;
 
     fn make_sig(body: &[u8], secret: &str) -> String {

crates/sprout-media/Cargo.toml

@@ -20,10 +20,10 @@ hex = { workspace = true }
 chrono = { workspace = true }
 axum = { workspace = true }
 s3 = { version = "0.37", package = "rust-s3", default-features = false, features = ["tokio-rustls-tls", "fail-on-err", "tags"] }
-infer = "0.16"
+infer = "0.19"
 image = { version = "0.25", default-features = false, features = ["jpeg", "png", "gif", "webp"] }
 blurhash = "0.2"
-imagesize = "0.13"
+imagesize = "0.14"
 bytes = "1"
 
 [dev-dependencies]

crates/sprout-proxy/src/shadow_keys.rs

@@ -21,7 +21,7 @@
 use std::sync::atomic::{AtomicUsize, Ordering};
 
 use dashmap::DashMap;
-use hmac::{Hmac, Mac};
+use hmac::{Hmac, KeyInit, Mac};
 use nostr::util::hex;
 use nostr::{Keys, SecretKey};
 use sha2::Sha256;

crates/sprout-relay/Cargo.toml

@@ -41,7 +41,7 @@ base64 = "0.22"
 sprout-workflow = { workspace = true, features = ["reqwest"] }
 sprout-media = { workspace = true }
 bytes = "1"
-infer = "0.16"
+infer = "0.19"
 serde_yaml      = { workspace = true }
 sha2            = { workspace = true }
 hex             = { workspace = true }

crates/sprout-workflow/Cargo.toml

@@ -16,7 +16,7 @@ serde_json  = { workspace = true }
 serde_yaml  = { workspace = true }
 dashmap     = { workspace = true }
 evalexpr    = "11"
-cron        = "0.12"
+cron        = "0.16"
 uuid        = { workspace = true }
 chrono      = { workspace = true }
 tokio       = { workspace = true }

desktop/package.json

@@ -3,7 +3,7 @@
   "private": true,
   "version": "0.1.0",
   "type": "module",
-  "packageManager": "pnpm@10.12.1",
+  "packageManager": "pnpm@10.33.0",
   "scripts": {
     "dev": "vite",
     "build": "tsc && vite build",
@@ -72,7 +72,7 @@
     "postcss": "^8.5.8",
     "tailwindcss": "^3.4.17",
     "tailwindcss-animate": "^1.0.7",
-    "typescript": "~5.8.3",
+    "typescript": "~5.9.0",
     "vite": "^7.0.4"
   }
 }