Lock file maintenance

[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

Renovate lock-file maintenance review — no findings

Reviewed both lockfiles (nexus/Cargo.lock, ui/package-lock.json) against .claude/REVIEW.md. No source, logging, or config changes, so the PII/secret-logging criterion is N/A. I read the upstream release notes for every non-trivial bump; nothing looks like a regression risk. Details below for the record.

Worth landing for

next 16.3.2 → 16.3.3 is a critical security release. Per the release notes it fixes two unauthenticated RCE advisories:

• GHSA-p293-qw3h-jr36 — unauthenticated RCE on Windows-hosted servers
• GHSA-2xp9-vwfh-vxw4 — unauthenticated RCE in the Image Optimization API when AVIF files are used

Neither is exploitable in PeerDB as shipped: the UI runs in Linux containers, and ui/next.config.js sets images: { unoptimized: true }, which disables the Image Optimization API. (Both advisories are still private, so they do not resolve in the GitHub Advisory DB yet.) Still the strongest reason to merge this.

mysql_async 0.37.0 → 0.37.1 — fixes a data race in the statement cache (blackbeam/mysql_async#406); this is where the new arc-swap edge in Cargo.lock comes from. Directly relevant, nexus/peer-mysql depends on it.

aws-lc-rs 1.18.0 → 1.18.1 / aws-lc-sys 0.44.0 → 0.45.0 — realigns to AWS-LC v5.7.0 (from v5.5.0), which corrects EVP_DecryptUpdate for padded block ciphers so it only writes the range reported via out_len. This is the TLS backend for pgwire (server-api-aws-lc-rs), tokio-postgres-rustls, mysql_async and reqwest, so it is the one bump here with a non-zero behaviour surface: 1.18.1 also tightens AEAD / cipher-IV / HKDF / ECDH / RSA API contracts so non-conforming inputs now return Err(Unspecified) instead of proceeding. Upstream states valid inputs are unaffected, and rustls only feeds conforming inputs — plus clippy and the UI build are green. No MSRV or cmake/bindgen build-requirement change.

Notable but benign

• rust_decimal 1.42.1 → 1.43.0 — drops the rkyv 0.7 feature bridge, which is what accounts for the net −180 lines: 16 crates leave the graph (rkyv, rkyv_derive, bitvec, bytecheck(+_derive), ptr_meta(+_derive), radium, rend, simdutf8, tap, wyz, funty, ahash 0.7, hashbrown 0.12, and syn 1.0.109, now gone from the tree entirely). The one behaviour change is a fix for a missing negative sign in array_string, which nexus does not call. nexus pins default-features = false, features = ["tokio-pg"], so the rkyv/rand feature bridges were never enabled — both rand 0.8.8 and 0.9.5 now sit in the lock as unactivated optional deps, exactly as rkyv did before.
• protobufjs 8.7.2 → 8.8.0 — hardening for ProtoJSON/text-format parsing, recursion limits in Any.fromObject, decoder now respects declared lengths. Additive; the UI uses @bufbuild/protobuf directly and protobufjs is only transitive.
• zod 4.4.3 → 4.5.4 — additive only (z.compile, z.validate, z.deepPartial, new locales); no documented breaking changes across 4.5.0–4.5.4.
• webpack 5.109.2 → 5.110.2 is the largest single minor here (CJS tree-shaking, built-in HTML/CSS minification, lazy concatenated-module accessors) — but it is a devDependency, ui/next.config.js defines no webpack() hook, and Next 16 builds with Turbopack, so it is not in the build path. Same for terser 5.51.2 and minimizer-webpack-plugin 5.8.0.
• sharp 0.35.4 / @img/sharp-libvips 1.3.3 — libvips 8.18.6 with coordinate-bounds and stream-lifecycle fixes. No advisory attached.
• Remainder is routine: AWS SDK crates, smallvec 1.16.0, tinyvec 1.13.2, indexmap 2.14.2, crossbeam-*, wasm-bindgen 0.2.128, syn 3.0.5, zstd-sys 2.1.0 (bundled zstd stays 1.5.7), typescript-eslint 8.68.0, and caniuse-lite/electron-to-chromium data refreshes.

Hygiene checks

• No packages added to ui/package-lock.json; the only removals are webpack's nested eslint-scope 5.1.1 / estraverse 4.3.0.
• Every resolved URL still points at registry.npmjs.org, and every Cargo source is still registry+https://github.com/rust-lang/crates.io-index — no registry substitution.
• All resolved versions satisfy the declared ranges in ui/package.json and nexus/*/Cargo.toml; no manifest edits were needed.
• Checked the GitHub Advisory DB for webpack, sharp, protobufjs and aws-lc-sys: no advisory is newly resolved by this bump beyond the Next.js one above.

One process note: renovate/stability-days is still pending ("Updates have not met minimum release age requirement"), so this should not be force-merged past that gate.

[claude]

rust_decimal 1.42.1 → 1.43.0 — the one bump in this PR worth a closer look. Released 2026-09-02, so it is 5 days old.

Directly relevant fixes (upstream #808, a backport of #807):

• "Postgres FromSql panics on legitimate large NUMERIC values" — 10i128.pow(4 * start_integers) overflowed for weights ≥ 11 (i.e. 10^44). It now uses checked_pow and returns ExceedsMaximumPossibleValue instead of panicking. nexus/peer-postgres/src/stream.rs:153 (let numeric: Option<Decimal> = row.get(i)) goes through exactly that FromSql path, so this bump removes a real panic on wide PG NUMERIC. Worth confirming the new Err surfaces as a query error rather than being swallowed.
• from_str no longer silently ignores non-digit garbage after the 29th significant digit (now InvalidCharacter / DuplicatedDecimalPoint). Long-but-valid digit strings are unaffected, so nexus/peer-bigquery/src/stream.rs:150 (Decimal::from_str(&result)? for NUMERIC/BIGNUMERIC) should behave the same.

Regression risk to be aware of:

• Upstream #809 rewrote the hot arithmetic paths: u128 fast paths for 64-bit mul/add/sub, rescale_internal scaling in chunks of up to 9 digits instead of one at a time, truncate_internal reporting discarded fractions so floor/ceil truncate once, and PartialEq short-circuiting on identical bit patterns. The author states rounding semantics are preserved, but this is a fresh rewrite of the code that rescales and renders every Value::Numeric nexus emits.
• adding IF NOT EXISTS for pg and bq #808 also carries "math precision improvements" that shift division and ln results by 1–2 ULP, with several upstream test expectations updated. Nexus transports decimals rather than computing on them, so this is unlikely to bite — but a numeric-heavy e2e pass (PG NUMERIC, BigQuery NUMERIC/BIGNUMERIC) before merge would be cheap insurance on a 5-day-old release.

Side benefit: dropping the rkyv 0.7 feature bridge (#819) removes rkyv, rkyv_derive, bitvec, bytecheck, ptr_meta, radium, rend, simdutf8, tap, wyz, ahash 0.7, hashbrown 0.12 and the last syn 1.0.109 from the tree. No functional impact, since nexus builds this crate with default-features = false, features = ["tokio-pg"].

[claude]

next 16.3.2 → 16.3.3 is a security release — flagging so this does not sit unmerged. Per the v16.3.3 notes it fixes two advisories, both rated critical:

• GHSA-p293-qw3h-jr36 — unauthenticated RCE on Windows-hosted servers
• GHSA-2xp9-vwfh-vxw4 — unauthenticated RCE in the Image Optimization API when AVIF files are used

Actual exposure for the PeerDB UI looks low on both counts: it ships in a Linux container (not Windows-hosted), and ui/next.config.js:17-19 sets images: { unoptimized: true }, which takes the Image Optimization API out of the picture. No regression risk in the bump itself — the release lists no other changes.

[claude]

webpack 5.109.2 → 5.110.2 — the refresh stopped one patch short. 5.110.3 was published 2026-09-01, six days before this lock was regenerated (branch commit dated 2026-09-07). It is currently latest on npm, not deprecated, and still engines: node >=10.13.0, so ^5.99.7 should have resolved to it. A rebase/retry may be worth a shot to see whether Renovate picks it up.

It matters a little because 5.110.0 (2026-08-27) is a substantial minor — it wraps concatenated modules in lazy __webpack_require__.cw accessors and inlines require() (#21519) — and .1/.2/.3 are all regression fixes layered on that rework. 5.110.3 specifically fixes import() options, ESM interop when require() targets a module outside the concatenation, concatenated require() inside a require.ensure callback, mangled exports read through require(), and new on a default import of a wrapped CommonJS module. It also reverts optimization.minimize to a boolean (options moving to minimizeOptions) after 5.110.1 had loosened it.

Mitigating: this entry is dev: true, and nothing under ui/ references webpack outside package.json — next.config.js has no webpack() hook, so it is not on the Next build path. Low practical risk either way; noting it mainly because "lock file maintenance" implies a full refresh.

[claude]

mysql_async 0.37.0 → 0.37.1 — patch release whose only listed change is "Fix data race in statement cache" (upstream issue #406). The new arc-swap dependency appearing in this same hunk is that fix. Straightforwardly good for nexus/peer-mysql; no behavior change to review.

[claude]

rustls 0.23.43 → 0.23.44 — three changes, two worth noting, one of which lands squarely on the "do not leak secrets" rule in .claude/REVIEW.md:

• KeyLogFile now creates the SSLKEYLOGFILE with owner-only permissions (#3210). Previously those TLS session keys were written world-readable.
• Server certificates are now verified against the correct name on ECH rejection (#3236).
• Default flip: ML-DSA post-quantum certificates are now enabled by default in the aws-lc-rs provider (#3249). Nexus reaches that provider via pgwires server-api-aws-lc-rs feature (nexus/Cargo.toml:35). ML-DSA is not in the public web PKI, so this only widens what a private CA hierarchy may present — no expected impact, but it is a default changing inside the TLS stack.

[claude]

aws-lc-rs 1.18.0 → 1.18.1 / aws-lc-sys 0.44.0 → 0.45.0 — the 1.18.1 notes tighten several API contracts so inconsistent inputs now fail closed with Err(Unspecified) instead of being accepted (#1215): in-place AEAD sealing verifies Extend produced exactly enough space, streaming cipher constructors reject missing/mismatched IV contexts, RSA verify_digest_sig requires the supplied digest to match RsaParameters, and Salt::from(Okm) now uses the Okms output algorithm rather than the source PRKs. Upstream states valid inputs are unaffected, and nexus only consumes this transitively through rustls/pgwire, so it should be a no-op here.

aws-lc-sys 0.45.0 moves the vendored AWS-LC from v5.5.0 to v5.7.0, which corrects EVP_DecryptUpdate for padded block ciphers so it only modifies the output range reported through out_len. Since this is the C-compiling sys crate, it is also the bump most likely to affect the nexus image build — the release includes a fix for -Wa,--debug-prefix-map under Clang + LTO (now using -ffile-prefix-map) and CFLAGS filtering for jitterentropy, so worth an eye on the Rust build job and not just the tests.

[claude]

protobufjs 8.7.2 → 8.8.0 — hardening release, no API break. All three fixes are on the decode path: "Harden ProtoJSON and Text Format parsing" (#2418), "Limit Any.fromObject recursion" (#2419), and "Respect declared lengths while decoding" (#2420). The minor bump itself is Edition 2026 support (#2414), which is additive. Good to take.

[claude]

zod 4.4.3 → 4.5.4 — a minor, but nothing in this range changes default behavior.

4.5.0s headline is z.compile(), which walks a schema and emits flat JS executed via new Function(). It is strictly opt-in — nothing auto-compiles unless global auto-compilation is turned on — so it introduces no new unsafe-eval requirement for the UIs CSP as long as it is not adopted. The rest of the 4.5.x line is fixes: 4.5.4 stops the cycle walk from firing a default factory (#6500), 4.5.3 emits record numeric keys as strings in toJSONSchema (#6497), 4.5.2 lets a prototype-method getter answer a bare call so vi.spyOn works (#6488).

That last one is the only thing I would sanity-check: the advertised 9x schema-memory reduction comes from lazy-bound methods, and if any UI code pulls a schema method off the instance and calls it detached, that is where it would show up. The genuinely breaking changes in this range (.merge() throwing when the receiver has refinements, base64 rejecting whitespace, stricter HTTP URL validation) all landed in 4.4.0, which main is already on.

[claude]

terser 5.50.0 → 5.51.2 — minifier semantics moved across this range, so noting it even though the blast radius here looks nil. 5.51.0 deoptimizes ("pins") functions whose argnames scope is ambiguous — default arguments referencing other parameters or outer variables — and fixes ?? being misclassified as a boolean operator, which was generating booleans on its left-hand side. 5.51.1 fixes code transformation inside dynamic import() arguments, and 5.51.2 then reverts part of the argname pinning due to "issues that came up without clear reproduction". Three releases of churn in a minifier.

Only reachable transitively through webpacks minimizer-webpack-plugin (also bumped here, 5.6.1 → 5.8.0), and webpack is not on the Next build path for this UI, so I would expect no effect on shipped output.

[claude]

Dependency bump review (per .claude/REVIEW.md)

Reviewed per .claude/REVIEW.md. No blocking findings — lockfile-only change, every bump lands inside the ranges already declared in nexus/Cargo.toml / ui/package.json, and no source files are touched.

Rule 1 (PII / secrets in output): not applicable — no code changes, so no new stdout/stderr/log statements.

Rule 2 (regressions in the bumped range): upstream notes read for the material bumps. Findings below.

Supply-chain sanity

• Spot-checked integrity for zod@4.5.4 and next@16.3.4 against registry.npmjs.org — both match.
• No new source = / git+ entries in Cargo.lock, and every new resolved URL is registry.npmjs.org. No source substitutions.

Notable: this bump is a security fix on the SSH path

• libssh2-sys 0.3.2 → 0.3.3. 0.3.2 was yanked from crates.io — it shipped with a stale vendored libssh2 submodule and therefore without the fix for CVE-2025-15661 (heap over-read in sftp_symlink(), CVSS 8.3; a malicious or MITM SFTP server can leak heap memory or crash the client). 0.3.3 ships the patched submodule plus the follow-up error-parsing fix (rust-lang/ssh2-rs#363).
  Not reachable in PeerDB today: nexus/postgres-connection/src/lib.rs:119 uses channel_direct_tcpip for port forwarding only, and there are no SFTP calls anywhere in nexus. Still worth merging — it moves us off a yanked crate version.

Correctness fixes we pick up

• mysql_async 0.37.0 → 0.37.1 — fixes a data race in the statement cache (#406). Directly relevant to nexus/peer-mysql.
• rustls 0.23.43 → 0.23.44 — KeyLogFile now created owner-read-only (hardening); fixes server-cert verification against the correct hostname when ECH is rejected; ML-DSA certs enabled by default in the aws-lc-rs provider (private hierarchies only, no public-PKI impact).
• aws-lc-sys 0.44 → 0.45 (AWS-LC 5.5.0 → 5.7.0) — EVP_DecryptUpdate no longer writes outside the range reported via out_len; RSA verify_digest_sig now enforces digest/RsaParameters agreement; ECDH secrets zeroized on failed derive paths. The tightened error paths only affect direct in-place AEAD callers — nexus reaches aws-lc only through rustls/pgwire.
• compression-core 0.4.32 → 0.4.33 — WriteBuffer::assume_init initialization tracking fix, with bounds checks now enforced in release builds (soundness). async-compression 0.4.45 is the zstd 0.13 → 0.14 move, which is what drags in zstd-safe 7.3.0 / zstd-sys 2.1.0 — same underlying zstd 1.5.7, bindings only.

Heads-up worth a reviewer glance (not blocking)

• zod 4.4.3 → 4.5.4 is the only bump whose upstream notes list breaking changes reaching app code. I checked all four consumers (ui/app/peers/create/[peerType]/schema.ts, ui/app/mirrors/create/schema.ts, ui/app/alert-config/validation.ts, ui/components/PeerForms/Eventhubs/schema.ts):
  • Not affected: z.iso.datetime() minute-precision, the z.record() key-governance change, .merge() refinement throw, required z.undefined() props, __proto__ stripping, base64 whitespace, and the z.httpUrl()/IPv6/ULID/emoji tightening — none of those APIs are used. .url() (used for the BigQuery authUri/tokenUri/cert URLs) is unchanged; only httpUrl got stricter.
  • Does apply: string .min()/.max() now count Unicode code points instead of UTF-16 units. That shifts the effective limit for the many .max(255) / .max(100) bounds on host/user/database/password fields, but only when the input contains non-BMP characters (emoji, CJK ext) — such a value now measures shorter and can pass client-side validation where it previously failed. Practically negligible for credentials, and server-side limits remain authoritative, but flagging it as a silent semantic change.
  • The zod/v4 subpath (used via import * as z from zod/v4) is still exported in 4.5.4 — verified against the published package.
• terser 5.50.0 → 5.51.2 — 5.51.0 added function pinning for ambiguously-scoped default args, which caused unexplained breakage and was reverted in 5.51.2. Net effect of the pinned version vs. 5.50.0 is just the ??-as-boolean fix and the dynamic-import()-args transform fix, so we land on the safe end of that range. Next 16 minifies with SWC anyway.
• webpack 5.109.2 → 5.110.3 — 5.110.0 made optimization.minimize strictly boolean (options moved to minimizeOptions) and turned on CommonJS module concatenation by default. ui/next.config.js has no webpack hook and no optimization block, and Next bundles its own webpack copy, so the top-level dep is not on the build path. Confirmed by Build & Test UI passing.
• protobufjs 8.7.2 → 8.8.0 adds ProtoJSON/Text-Format parsing hardening, an Any.fromObject recursion cap, and stricter decode length handling. No impact here: protobufjs is declared in ui/package.json but not imported anywhere in the UI source — the UI uses @bufbuild/protobuf. Possible dead-dependency cleanup for a separate PR.
• sharp 0.35.3 → 0.35.4 (libvips 8.18.6, coordinate-limit bounds fixes) is inert — next.config.js sets images.unoptimized: true.

Dependency-tree win

rust_decimal 1.43.0 drops rkyv 0.7 from its feature bridge, which prunes rkyv/rkyv_derive/bytecheck/bitvec/funty/radium/tap/wyz/ptr_meta/rend/simdutf8 plus the last ahash 0.7, hashbrown 0.12 and syn 1.0 from nexus. nexus only uses Decimal for parse/hold (nexus/value/src/lib.rs:175), no arithmetic, so 1.43.0 s arithmetic reworks are off our path.

CI

build (Go matrix 1.14–1.18), clippy, docker-build, Build & Test UI, Run UI linters, ESLint, Prettier and both CodeQL analyses are green. flow_test (all three matrix legs) was still running at review time — worth confirming green before merge given the mysql_async and rust_decimal bumps. renovate/stability-days is also still pending (minimum release age not met), so this should not be merged until that clears.