[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

Renovate lock-file maintenance review — no findings

Reviewed both lockfiles (nexus/Cargo.lock, ui/package-lock.json) against .claude/REVIEW.md. No source, logging, or config changes, so the PII/secret-logging criterion is N/A. I read the upstream release notes for every non-trivial bump; nothing looks like a regression risk. Details below for the record.

Worth landing for

next 16.3.2 → 16.3.3 is a critical security release. Per the release notes it fixes two unauthenticated RCE advisories:

• GHSA-p293-qw3h-jr36 — unauthenticated RCE on Windows-hosted servers
• GHSA-2xp9-vwfh-vxw4 — unauthenticated RCE in the Image Optimization API when AVIF files are used

Neither is exploitable in PeerDB as shipped: the UI runs in Linux containers, and ui/next.config.js sets images: { unoptimized: true }, which disables the Image Optimization API. (Both advisories are still private, so they do not resolve in the GitHub Advisory DB yet.) Still the strongest reason to merge this.

mysql_async 0.37.0 → 0.37.1 — fixes a data race in the statement cache (blackbeam/mysql_async#406); this is where the new arc-swap edge in Cargo.lock comes from. Directly relevant, nexus/peer-mysql depends on it.

aws-lc-rs 1.18.0 → 1.18.1 / aws-lc-sys 0.44.0 → 0.45.0 — realigns to AWS-LC v5.7.0 (from v5.5.0), which corrects EVP_DecryptUpdate for padded block ciphers so it only writes the range reported via out_len. This is the TLS backend for pgwire (server-api-aws-lc-rs), tokio-postgres-rustls, mysql_async and reqwest, so it is the one bump here with a non-zero behaviour surface: 1.18.1 also tightens AEAD / cipher-IV / HKDF / ECDH / RSA API contracts so non-conforming inputs now return Err(Unspecified) instead of proceeding. Upstream states valid inputs are unaffected, and rustls only feeds conforming inputs — plus clippy and the UI build are green. No MSRV or cmake/bindgen build-requirement change.

Notable but benign

• rust_decimal 1.42.1 → 1.43.0 — drops the rkyv 0.7 feature bridge, which is what accounts for the net −180 lines: 16 crates leave the graph (rkyv, rkyv_derive, bitvec, bytecheck(+_derive), ptr_meta(+_derive), radium, rend, simdutf8, tap, wyz, funty, ahash 0.7, hashbrown 0.12, and syn 1.0.109, now gone from the tree entirely). The one behaviour change is a fix for a missing negative sign in array_string, which nexus does not call. nexus pins default-features = false, features = ["tokio-pg"], so the rkyv/rand feature bridges were never enabled — both rand 0.8.8 and 0.9.5 now sit in the lock as unactivated optional deps, exactly as rkyv did before.
• protobufjs 8.7.2 → 8.8.0 — hardening for ProtoJSON/text-format parsing, recursion limits in Any.fromObject, decoder now respects declared lengths. Additive; the UI uses @bufbuild/protobuf directly and protobufjs is only transitive.
• zod 4.4.3 → 4.5.4 — additive only (z.compile, z.validate, z.deepPartial, new locales); no documented breaking changes across 4.5.0–4.5.4.
• webpack 5.109.2 → 5.110.2 is the largest single minor here (CJS tree-shaking, built-in HTML/CSS minification, lazy concatenated-module accessors) — but it is a devDependency, ui/next.config.js defines no webpack() hook, and Next 16 builds with Turbopack, so it is not in the build path. Same for terser 5.51.2 and minimizer-webpack-plugin 5.8.0.
• sharp 0.35.4 / @img/sharp-libvips 1.3.3 — libvips 8.18.6 with coordinate-bounds and stream-lifecycle fixes. No advisory attached.
• Remainder is routine: AWS SDK crates, smallvec 1.16.0, tinyvec 1.13.2, indexmap 2.14.2, crossbeam-*, wasm-bindgen 0.2.128, syn 3.0.5, zstd-sys 2.1.0 (bundled zstd stays 1.5.7), typescript-eslint 8.68.0, and caniuse-lite/electron-to-chromium data refreshes.

Hygiene checks

• No packages added to ui/package-lock.json; the only removals are webpack's nested eslint-scope 5.1.1 / estraverse 4.3.0.
• Every resolved URL still points at registry.npmjs.org, and every Cargo source is still registry+https://github.com/rust-lang/crates.io-index — no registry substitution.
• All resolved versions satisfy the declared ranges in ui/package.json and nexus/*/Cargo.toml; no manifest edits were needed.
• Checked the GitHub Advisory DB for webpack, sharp, protobufjs and aws-lc-sys: no advisory is newly resolved by this bump beyond the Next.js one above.

One process note: renovate/stability-days is still pending ("Updates have not met minimum release age requirement"), so this should not be force-merged past that gate.

[claude]

rust_decimal 1.42.1 → 1.43.0 — the one bump in this PR worth a closer look. Released 2026-09-02, so it is 5 days old.

Directly relevant fixes (upstream #808, a backport of #807):

• "Postgres FromSql panics on legitimate large NUMERIC values" — 10i128.pow(4 * start_integers) overflowed for weights ≥ 11 (i.e. 10^44). It now uses checked_pow and returns ExceedsMaximumPossibleValue instead of panicking. nexus/peer-postgres/src/stream.rs:153 (let numeric: Option<Decimal> = row.get(i)) goes through exactly that FromSql path, so this bump removes a real panic on wide PG NUMERIC. Worth confirming the new Err surfaces as a query error rather than being swallowed.
• from_str no longer silently ignores non-digit garbage after the 29th significant digit (now InvalidCharacter / DuplicatedDecimalPoint). Long-but-valid digit strings are unaffected, so nexus/peer-bigquery/src/stream.rs:150 (Decimal::from_str(&result)? for NUMERIC/BIGNUMERIC) should behave the same.

Regression risk to be aware of:

• Upstream #809 rewrote the hot arithmetic paths: u128 fast paths for 64-bit mul/add/sub, rescale_internal scaling in chunks of up to 9 digits instead of one at a time, truncate_internal reporting discarded fractions so floor/ceil truncate once, and PartialEq short-circuiting on identical bit patterns. The author states rounding semantics are preserved, but this is a fresh rewrite of the code that rescales and renders every Value::Numeric nexus emits.
• adding IF NOT EXISTS for pg and bq #808 also carries "math precision improvements" that shift division and ln results by 1–2 ULP, with several upstream test expectations updated. Nexus transports decimals rather than computing on them, so this is unlikely to bite — but a numeric-heavy e2e pass (PG NUMERIC, BigQuery NUMERIC/BIGNUMERIC) before merge would be cheap insurance on a 5-day-old release.

Side benefit: dropping the rkyv 0.7 feature bridge (#819) removes rkyv, rkyv_derive, bitvec, bytecheck, ptr_meta, radium, rend, simdutf8, tap, wyz, ahash 0.7, hashbrown 0.12 and the last syn 1.0.109 from the tree. No functional impact, since nexus builds this crate with default-features = false, features = ["tokio-pg"].

[claude]

next 16.3.2 → 16.3.3 is a security release — flagging so this does not sit unmerged. Per the v16.3.3 notes it fixes two advisories, both rated critical:

• GHSA-p293-qw3h-jr36 — unauthenticated RCE on Windows-hosted servers
• GHSA-2xp9-vwfh-vxw4 — unauthenticated RCE in the Image Optimization API when AVIF files are used

Actual exposure for the PeerDB UI looks low on both counts: it ships in a Linux container (not Windows-hosted), and ui/next.config.js:17-19 sets images: { unoptimized: true }, which takes the Image Optimization API out of the picture. No regression risk in the bump itself — the release lists no other changes.

[claude]

webpack 5.109.2 → 5.110.2 — the refresh stopped one patch short. 5.110.3 was published 2026-09-01, six days before this lock was regenerated (branch commit dated 2026-09-07). It is currently latest on npm, not deprecated, and still engines: node >=10.13.0, so ^5.99.7 should have resolved to it. A rebase/retry may be worth a shot to see whether Renovate picks it up.

It matters a little because 5.110.0 (2026-08-27) is a substantial minor — it wraps concatenated modules in lazy __webpack_require__.cw accessors and inlines require() (#21519) — and .1/.2/.3 are all regression fixes layered on that rework. 5.110.3 specifically fixes import() options, ESM interop when require() targets a module outside the concatenation, concatenated require() inside a require.ensure callback, mangled exports read through require(), and new on a default import of a wrapped CommonJS module. It also reverts optimization.minimize to a boolean (options moving to minimizeOptions) after 5.110.1 had loosened it.

Mitigating: this entry is dev: true, and nothing under ui/ references webpack outside package.json — next.config.js has no webpack() hook, so it is not on the Next build path. Low practical risk either way; noting it mainly because "lock file maintenance" implies a full refresh.

[claude]

mysql_async 0.37.0 → 0.37.1 — patch release whose only listed change is "Fix data race in statement cache" (upstream issue #406). The new arc-swap dependency appearing in this same hunk is that fix. Straightforwardly good for nexus/peer-mysql; no behavior change to review.

[claude]

rustls 0.23.43 → 0.23.44 — three changes, two worth noting, one of which lands squarely on the "do not leak secrets" rule in .claude/REVIEW.md:

• KeyLogFile now creates the SSLKEYLOGFILE with owner-only permissions (#3210). Previously those TLS session keys were written world-readable.
• Server certificates are now verified against the correct name on ECH rejection (#3236).
• Default flip: ML-DSA post-quantum certificates are now enabled by default in the aws-lc-rs provider (#3249). Nexus reaches that provider via pgwires server-api-aws-lc-rs feature (nexus/Cargo.toml:35). ML-DSA is not in the public web PKI, so this only widens what a private CA hierarchy may present — no expected impact, but it is a default changing inside the TLS stack.

[claude]

aws-lc-rs 1.18.0 → 1.18.1 / aws-lc-sys 0.44.0 → 0.45.0 — the 1.18.1 notes tighten several API contracts so inconsistent inputs now fail closed with Err(Unspecified) instead of being accepted (#1215): in-place AEAD sealing verifies Extend produced exactly enough space, streaming cipher constructors reject missing/mismatched IV contexts, RSA verify_digest_sig requires the supplied digest to match RsaParameters, and Salt::from(Okm) now uses the Okms output algorithm rather than the source PRKs. Upstream states valid inputs are unaffected, and nexus only consumes this transitively through rustls/pgwire, so it should be a no-op here.

aws-lc-sys 0.45.0 moves the vendored AWS-LC from v5.5.0 to v5.7.0, which corrects EVP_DecryptUpdate for padded block ciphers so it only modifies the output range reported through out_len. Since this is the C-compiling sys crate, it is also the bump most likely to affect the nexus image build — the release includes a fix for -Wa,--debug-prefix-map under Clang + LTO (now using -ffile-prefix-map) and CFLAGS filtering for jitterentropy, so worth an eye on the Rust build job and not just the tests.

[claude]

protobufjs 8.7.2 → 8.8.0 — hardening release, no API break. All three fixes are on the decode path: "Harden ProtoJSON and Text Format parsing" (#2418), "Limit Any.fromObject recursion" (#2419), and "Respect declared lengths while decoding" (#2420). The minor bump itself is Edition 2026 support (#2414), which is additive. Good to take.

[claude]

zod 4.4.3 → 4.5.4 — a minor, but nothing in this range changes default behavior.

4.5.0s headline is z.compile(), which walks a schema and emits flat JS executed via new Function(). It is strictly opt-in — nothing auto-compiles unless global auto-compilation is turned on — so it introduces no new unsafe-eval requirement for the UIs CSP as long as it is not adopted. The rest of the 4.5.x line is fixes: 4.5.4 stops the cycle walk from firing a default factory (#6500), 4.5.3 emits record numeric keys as strings in toJSONSchema (#6497), 4.5.2 lets a prototype-method getter answer a bare call so vi.spyOn works (#6488).

That last one is the only thing I would sanity-check: the advertised 9x schema-memory reduction comes from lazy-bound methods, and if any UI code pulls a schema method off the instance and calls it detached, that is where it would show up. The genuinely breaking changes in this range (.merge() throwing when the receiver has refinements, base64 rejecting whitespace, stricter HTTP URL validation) all landed in 4.4.0, which main is already on.

[claude]

terser 5.50.0 → 5.51.2 — minifier semantics moved across this range, so noting it even though the blast radius here looks nil. 5.51.0 deoptimizes ("pins") functions whose argnames scope is ambiguous — default arguments referencing other parameters or outer variables — and fixes ?? being misclassified as a boolean operator, which was generating booleans on its left-hand side. 5.51.1 fixes code transformation inside dynamic import() arguments, and 5.51.2 then reverts part of the argname pinning due to "issues that came up without clear reproduction". Three releases of churn in a minifier.

Only reachable transitively through webpacks minimizer-webpack-plugin (also bumped here, 5.6.1 → 5.8.0), and webpack is not on the Next build path for this UI, so I would expect no effect on shipped output.

[claude]

Dependency bump review (per .claude/REVIEW.md)

Reviewed per .claude/REVIEW.md. No blocking findings — lockfile-only change, every bump lands inside the ranges already declared in nexus/Cargo.toml / ui/package.json, and no source files are touched.

Rule 1 (PII / secrets in output): not applicable — no code changes, so no new stdout/stderr/log statements.

Rule 2 (regressions in the bumped range): upstream notes read for the material bumps. Findings below.

Supply-chain sanity

• Spot-checked integrity for zod@4.5.4 and next@16.3.4 against registry.npmjs.org — both match.
• No new source = / git+ entries in Cargo.lock, and every new resolved URL is registry.npmjs.org. No source substitutions.

Notable: this bump is a security fix on the SSH path

• libssh2-sys 0.3.2 → 0.3.3. 0.3.2 was yanked from crates.io — it shipped with a stale vendored libssh2 submodule and therefore without the fix for CVE-2025-15661 (heap over-read in sftp_symlink(), CVSS 8.3; a malicious or MITM SFTP server can leak heap memory or crash the client). 0.3.3 ships the patched submodule plus the follow-up error-parsing fix (rust-lang/ssh2-rs#363).
  Not reachable in PeerDB today: nexus/postgres-connection/src/lib.rs:119 uses channel_direct_tcpip for port forwarding only, and there are no SFTP calls anywhere in nexus. Still worth merging — it moves us off a yanked crate version.

Correctness fixes we pick up

• mysql_async 0.37.0 → 0.37.1 — fixes a data race in the statement cache (#406). Directly relevant to nexus/peer-mysql.
• rustls 0.23.43 → 0.23.44 — KeyLogFile now created owner-read-only (hardening); fixes server-cert verification against the correct hostname when ECH is rejected; ML-DSA certs enabled by default in the aws-lc-rs provider (private hierarchies only, no public-PKI impact).
• aws-lc-sys 0.44 → 0.45 (AWS-LC 5.5.0 → 5.7.0) — EVP_DecryptUpdate no longer writes outside the range reported via out_len; RSA verify_digest_sig now enforces digest/RsaParameters agreement; ECDH secrets zeroized on failed derive paths. The tightened error paths only affect direct in-place AEAD callers — nexus reaches aws-lc only through rustls/pgwire.
• compression-core 0.4.32 → 0.4.33 — WriteBuffer::assume_init initialization tracking fix, with bounds checks now enforced in release builds (soundness). async-compression 0.4.45 is the zstd 0.13 → 0.14 move, which is what drags in zstd-safe 7.3.0 / zstd-sys 2.1.0 — same underlying zstd 1.5.7, bindings only.

Heads-up worth a reviewer glance (not blocking)

• zod 4.4.3 → 4.5.4 is the only bump whose upstream notes list breaking changes reaching app code. I checked all four consumers (ui/app/peers/create/[peerType]/schema.ts, ui/app/mirrors/create/schema.ts, ui/app/alert-config/validation.ts, ui/components/PeerForms/Eventhubs/schema.ts):
  • Not affected: z.iso.datetime() minute-precision, the z.record() key-governance change, .merge() refinement throw, required z.undefined() props, __proto__ stripping, base64 whitespace, and the z.httpUrl()/IPv6/ULID/emoji tightening — none of those APIs are used. .url() (used for the BigQuery authUri/tokenUri/cert URLs) is unchanged; only httpUrl got stricter.
  • Does apply: string .min()/.max() now count Unicode code points instead of UTF-16 units. That shifts the effective limit for the many .max(255) / .max(100) bounds on host/user/database/password fields, but only when the input contains non-BMP characters (emoji, CJK ext) — such a value now measures shorter and can pass client-side validation where it previously failed. Practically negligible for credentials, and server-side limits remain authoritative, but flagging it as a silent semantic change.
  • The zod/v4 subpath (used via import * as z from zod/v4) is still exported in 4.5.4 — verified against the published package.
• terser 5.50.0 → 5.51.2 — 5.51.0 added function pinning for ambiguously-scoped default args, which caused unexplained breakage and was reverted in 5.51.2. Net effect of the pinned version vs. 5.50.0 is just the ??-as-boolean fix and the dynamic-import()-args transform fix, so we land on the safe end of that range. Next 16 minifies with SWC anyway.
• webpack 5.109.2 → 5.110.3 — 5.110.0 made optimization.minimize strictly boolean (options moved to minimizeOptions) and turned on CommonJS module concatenation by default. ui/next.config.js has no webpack hook and no optimization block, and Next bundles its own webpack copy, so the top-level dep is not on the build path. Confirmed by Build & Test UI passing.
• protobufjs 8.7.2 → 8.8.0 adds ProtoJSON/Text-Format parsing hardening, an Any.fromObject recursion cap, and stricter decode length handling. No impact here: protobufjs is declared in ui/package.json but not imported anywhere in the UI source — the UI uses @bufbuild/protobuf. Possible dead-dependency cleanup for a separate PR.
• sharp 0.35.3 → 0.35.4 (libvips 8.18.6, coordinate-limit bounds fixes) is inert — next.config.js sets images.unoptimized: true.

Dependency-tree win

rust_decimal 1.43.0 drops rkyv 0.7 from its feature bridge, which prunes rkyv/rkyv_derive/bytecheck/bitvec/funty/radium/tap/wyz/ptr_meta/rend/simdutf8 plus the last ahash 0.7, hashbrown 0.12 and syn 1.0 from nexus. nexus only uses Decimal for parse/hold (nexus/value/src/lib.rs:175), no arithmetic, so 1.43.0 s arithmetic reworks are off our path.

CI

build (Go matrix 1.14–1.18), clippy, docker-build, Build & Test UI, Run UI linters, ESLint, Prettier and both CodeQL analyses are green. flow_test (all three matrix legs) was still running at review time — worth confirming green before merge given the mysql_async and rust_decimal bumps. renovate/stability-days is also still pending (minimum release age not met), so this should not be merged until that clears.

[claude]

zod 4.4.3 → 4.5.4 — the one bump in this PR with documented breaking changes. This crosses 4.5.0, which upstream ships as a breaking release. Relevant to the four schema files that import it (ui/app/peers/create/[peerType]/schema.ts, ui/app/mirrors/create/schema.ts, ui/app/alert-config/validation.ts, ui/components/PeerForms/Eventhubs/schema.ts):

1. String .min()/.max()/.length() now count Unicode code points, not UTF-16 code units. Every string .min() in these schemas is .min(1), which is unaffected — any non-empty string has at least one code point. But the many .max(N) bounds now become more permissive for non-BMP input: password: z.string().max(100) will now accept a value longer than 100 UTF-16 units / 100 bytes. Those limits mirror backend and column limits, so a value can pass UI validation and then be rejected or truncated downstream. Low likelihood — it needs astral-plane characters in a host/user/password/database field — but it is a real widening of accepted input.
2. __proto__ is now always stripped from object and record parses, and .strict() reports it as unrecognized_keys.
3. Stricter string formats: z.ipv6(), z.ulid(), z.httpUrl() and z.emoji() all tightened. Worth a glance at the .url() validators in the BigQuery peer schema.

The zod/v4 subpath these files import still resolves — Build & Test UI and the linters pass — so this is a runtime-behavior change only, not a compile break. There are no tests covering these schemas, so nothing in CI would catch a validation regression here. Not a blocker, just the one item I would want confirmed by hand.

[claude]

next 16.3.2 → 16.3.4 closes two critical advisories — this is the strongest reason to merge:

• GHSA-2xp9-vwfh-vxw4 (critical) — unauthenticated RCE in the Image Optimization API when AVIF files are used. Affects >=16.0.0, <16.3.3; base 16.3.2 was in range.
• GHSA-p293-qw3h-jr36 (critical) — unauthenticated RCE on Windows-hosted servers. Same affected range.

Honest exposure assessment: ui/next.config.js sets unoptimized: true under images, which disables the Image Optimization API outright, and the UI ships as a Linux container — so neither advisory was exploitable in the PeerDB configuration. Still worth taking.

One thing to be aware of: 16.3.3 mitigated the AVIF RCE by disabling AVIF optimization, and 16.3.4 re-enables it (vercel/next.js#97949) on top of the actual fix. 16.3.4 is not in either affected range, so this is fine, but it is why the two-patch bump matters rather than stopping at 16.3.3. The remaining 16.3.4 fixes are unrelated: testmode passthrough-fetch infinite recursion, a TypeScript aliasing build error, and unset crossOrigin in Turbopack manifests.

[claude]

sharp 0.35.3 → 0.35.4 fixes GHSA-rgj7-g3m4-5g8c (high) — inherited libheif vulnerabilities (GHSA-g89c-p67h-r497, GHSA-2jg2-4ch7-h545), affected range <0.35.4, so the base version was vulnerable. The release also bundles libvips 8.18.6 and bounds resize and composite dimensions to the coordinate limit, preventing overflow.

Practical exposure is low — sharp is only reachable through the Next image optimizer, which this app disables via unoptimized: true — but this is a genuine high-severity fix, and the 15 @img/sharp-* platform-binary bumps elsewhere in this diff are the expected fallout.

[claude]

js-yaml 4.3.1 → 4.3.2 fixes GHSA-2883-xcg3-v3hh (high) — maxTotalMergeKeys fails to bound CPU consumption for empty merge sources, a denial of service. Affected range >=4.0.0, <4.3.2, so base 4.3.1 was vulnerable: 4.3.1 had fixed the previous omap advisory (GHSA-5p4m-2wfm-xmqj) but not this one.

Dev-only in this repo — it reaches the tree through ESLint config loading, not through anything that parses attacker-supplied YAML at runtime. Worth having regardless.

[claude]

terser 5.50.0 → 5.51.2 — upstream added a fix inside this range and then rolled it back, also inside this range. Sequence:

• 5.51.0: pinned (deoptimized) functions whose argnames scope is ambiguous — default arguments referencing other parameters or outer variables — plus fixed ?? being misclassified as a boolean operator, which produced incorrect boolean coercion on its left-hand side.
• 5.51.1: fixed transforming code inside a dynamic import() argument.
• 5.51.2: rolled back the 5.51.0 ambiguous-default-args deopt, "due to issues that came up without clear reproduction."

So the net delta is two real correctness fixes (?? classification, dynamic-import transform), and the one risky change was reverted before it reached this lock. Flagging it because an unexplained-breakage rollback inside a bumped range is exactly the signal .claude/REVIEW.md asks about. Blast radius is small: terser is a build-time transitive dev dependency, and Next 16 minifies with SWC rather than terser.

[claude]

webpack 5.109.2 → 5.110.3 — the largest single jump in this PR. 5.110.0 is a substantial minor: concatenated modules wrapped in lazy accessors with inline require() support, analyzable-ESM URLs for chunks/assets/workers, new CSS and HTML minification, an externalsPresets.nodeModules preset, and import.meta.glob changes.

The part worth noting is that all three following patches fix regressions in that new machinery: 5.110.1 (bad regex in snapshot.managedPaths, unparsable-module error handling, optimization.minimize shorthand plugin compat), 5.110.2 (analyzable-ESM baking around cycles, mixed-served wasm, style URL maps, TDZ and circular-reexport issues), 5.110.3 (import() options, circular reexports, ESM interop for require() targeting modules outside concatenation, mangled exports read through require(), new on wrapped CommonJS defaults). A minor that needed three rounds of module-resolution fixes is still settling.

Low risk here specifically: webpack is a devDependency used via copy-webpack-plugin, and Next 16 bundles with its own toolchain — Build & Test UI passing covers this path.

[claude]

zstd-sys 2.0.16 → 2.1.0 carries two metadata changes that the version bump alone does not convey. Verified against the crates.io API for both versions:

1. License changed from MIT/Apache-2.0 to BSD-3-Clause. BSD-3-Clause is permissive and compatible with the AGPL-3.0 of this repo, so there is no compliance conflict — but the attribution obligations differ (BSD-3-Clause adds a no-endorsement clause), so any generated attribution/NOTICE output should be refreshed. I found no deny.toml, about.toml or license-allowlist tooling in the repo, so nothing in CI gates this either way.
2. bindgen was dropped from the default features. 2.0.16 defaulted to legacy, zdict_builder, bindgen; 2.1.0 defaults to legacy, zdict_builder. Builds now use pre-generated bindings and no longer require libclang — a build-environment improvement. Safe here because the vendored C library is unchanged: both sides are +zstd.1.5.7, so the pre-generated bindings match the headers being compiled.

No advisories affect either version. Paired with zstd-safe 7.2.4 → 7.3.0.

[claude]

rust_decimal 1.42.1 → 1.43.0 — this is what prunes 16 crates from the lock. 1.43.0 removes the rkyv 0.7 feature bridge, which drops rkyv, rkyv_derive, bytecheck, bytecheck_derive, bitvec, funty, radium, tap, wyz, rend, ptr_meta, ptr_meta_derive, simdutf8, ahash 0.7, hashbrown 0.12 and syn 1.0.

I verified this is a safe prune rather than a silent feature loss: nexus/Cargo.toml declares rust_decimal with default-features = false and only the tokio-pg feature, so rkyv serialization was never enabled — and the only consumer of rkyv in the base lock was rust_decimal itself. Losing syn 1.0 and ahash 0.7 is a nice proc-macro and build-time win too.

The part to watch: 1.43.0 also backports accumulated fixes and performance work across the arithmetic paths, and 1.42.1 (already in base) was itself a carry-propagation correctness fix in subtraction. rust_decimal is used by value, peer-postgres, peer-mysql and peer-bigquery for NUMERIC handling, so decimal precision and rounding sit directly in the replication path. clippy passes, but the flow_test matrices were still pending at review time — please let those finish rather than relying on the lint jobs alone.

[claude]

mysql_async 0.37.0 → 0.37.1 is a targeted bug fix worth calling out as a win: it fixes a data race in the prepared-statement cache (blackbeam/mysql_async#406). No API or behavior changes.

This lands directly in the PeerDB MySQL path — nexus/peer-mysql depends on it with the minimal-rust, rust_decimal, chrono, rustls-tls and aws-lc-rs features. A statement-cache race is the kind of defect that surfaces as rare, hard-to-reproduce corruption or panics under concurrent query load, so this is a straightforward improvement for MySQL peers.

[claude]

rustls 0.23.43 → 0.23.44 — one hardening fix and one default-on behavior change.

• KeyLogFile now creates files readable only by the owner. Directly relevant to the secrets concern in .claude/REVIEW.md: if SSLKEYLOGFILE is ever set in a PeerDB deployment, TLS session secrets were previously written with default (world-readable) permissions. This tightens that.
• Fixed server-certificate verification against the correct name when the server rejects Encrypted Client Hello.
• ML-DSA post-quantum certificate support is now enabled by default in the aws-lc-rs provider. nexus uses that provider throughout — pgwire with server-api-aws-lc-rs, mysql_async with aws-lc-rs — so this widens the set of accepted signature schemes by default. It is private-PKI only, not public web PKI, so real-world impact is minimal; noting it because it is a default change rather than opt-in.

No advisories affect 0.23.43 — the most recent rustls advisories cap at <0.23.18. Paired with aws-lc-sys 0.44 → 0.45, which I also checked: all known aws-lc-sys advisories were patched by 0.39.0, so that bump is routine.

[github-actions]

🔄 Flaky Test Detected

Analysis: The flow/e2e package hit its 20-minute Go test timeout on only the ch-lts matrix leg, mass-failing all 55 in-flight TestPeerFlowE2ETestSuiteMySQL_CH_Cluster subtests with uniform ~61s STATUS_SETUP/STATUS_SNAPSHOT wait timeouts (no assertion mismatches, no deadlock in PeerDB code) while the same commit passed on the other two legs — a shared ClickHouse/Temporal resource stall on a Renovate lock-file PR, not a real bug.
Confidence: 0.85

✅ Automatically retrying the workflow

View workflow run

[claude]

Reviewed this lock file maintenance bump (nexus/Cargo.lock + ui/package-lock.json). No findings — looks clean.

Diff is lock-only: no Cargo.toml / package.json constraint changes, no new packages introduced (only upgrades plus some transitive removals), every added entry carries an integrity/checksum, and all resolved/source values point at registry.npmjs.org / crates.io. No logging or output changes, so nothing relevant to the PII/secrets rule.

Upstream release notes for the notable ranges

Positives / why this is worth taking

• next 16.3.2 → 16.3.4 — pulls in the two critical fixes from 16.3.3: unauthenticated RCE on Windows-hosted servers (GHSA-p293-qw3h-jr36 / CVE-2026-75604) and unauthenticated RCE in the Image Optimization API via AVIF/libheif (GHSA-2xp9-vwfh-vxw4). Neither was exploitable here (we ship Linux containers and next.config.js sets images: { unoptimized: true }), but good hardening regardless. 16.3.4 re-enables AVIF optimization and fixes testmode fetch recursion, @typescript/typescript6 aliasing, and Turbopack crossOrigin.
• mysql_async 0.37.0 → 0.37.1 — single fix: data race in the statement cache (Data race and use-after-free in ColumnCache (MariaDB result set metadata cache) blackbeam/mysql_async#406). Directly relevant to the MySQL CDC connector.
• protobufjs 8.7.2 → 8.8.0 — hardened ProtoJSON/Text Format parsing, Any.fromObject recursion limit, respects declared lengths while decoding. Edition 2026 support is additive.
• rustls 0.23.43 → 0.23.44 — SSLKEYLOGFILE now written owner-only; ECH rejection verifies the cert against the correct hostname.
• sharp 0.35.3 → 0.35.4 (libvips 1.3.3) — bounds-clamping on resize/composite dimensions; no security notes.

Things I checked that could have bitten but do not

• zod 4.4.3 → 4.5.4 — 4.5 ships documented breaking changes despite being a minor: .min()/.max()/.length() now count Unicode code points instead of UTF-16 units, z.iso.datetime() requires seconds, and ipv6/ulid/httpUrl/emoji got stricter. Our four schemas (app/peers/create/[peerType]/schema.ts, app/mirrors/create/schema.ts, app/alert-config/validation.ts, components/PeerForms/Eventhubs/schema.ts) only use plain z.string()/z.int() with .min()/.max(), no format validators — so the only reachable change is that .max(255) on host/db/table names becomes marginally more permissive for multi-byte input. No action needed.
• webpack 5.109.2 → 5.110.3 — 5.110.0 is a large feature release (lazy __webpack_require__.cw concatenation wrappers, ESM baking, CSS minification) and .1/.2/.3 are all bugfix patches against that new machinery. Low risk for us: webpack and copy-webpack-plugin are devDependencies that nothing in ui/ actually references, and Next builds with its own vendored copy.
• rust_decimal 1.42.1 → 1.43.0 — drops rkyv 0.7 from the feature bridge, which is what removes the rkyv/bitvec/funty/radium/tap/wyz/ptr_meta/rend/bytecheck/simdutf8 + ahash 0.7 / hashbrown 0.12 / syn 1.0.109 subtree from Cargo.lock. Pure dependency-graph shrink; also fixes a missing negative sign in array_string.
• aws-lc-rs 1.18.1 / aws-lc-sys 0.44 → 0.45 (AWS-LC v5.5.0 → v5.7.0) — API contracts tightened to fail closed on inconsistent AEAD/IV/HKDF/RSA configurations. Upstream states valid inputs are unaffected; we only reach this through rustls defaults. rustls 0.23.44 additionally enables ML-DSA certs by default in the aws-lc-rs provider, but for private PKI only.
• jiti dropped from ui/package-lock.json — it is an optional peer of eslint used only to load TypeScript flat configs. We use eslint.config.mjs, and the ESLint/Prettier/UI-lint checks are green, so this is a no-op.

CI

clippy, Build & Test UI, Run UI linters, ESLint, Prettier, docker-build and all build (14..18) jobs are green. flow_test matrices were still running at review time. Note that renovate/stability-days is still pending ("Updates have not met minimum release age requirement") — worth letting that clear before merging.

[claude]

Blocking — this bump breaks the nexus build.

aws-smithy-types 1.7.0 (published 2026-09-14) makes a breaking change inside a minor version: Document is now #[non_exhaustive] with four new variants (Blob, Timestamp, BigInteger, BigDecimal), and Document::Object now wraps DocumentObject instead of HashMap<String, Document>.

aws-smithy-json 0.63.0 is still in the tree (see line 225) and was written against 1.6.x, so Cargo unifying everything onto aws-smithy-types 1.7.0 makes it fail to compile:

error[E0308]: mismatched types
   --> aws-smithy-json-0.63.0/src/deserialize/token.rs:323:33
    |
323 |             Ok(Document::Object(object))
    |                ---------------- ^^^^^^ expected `DocumentObject`, found `HashMap<String, Document>`

error[E0004]: non-exhaustive patterns: `&_` not covered
  --> aws-smithy-json-0.63.0/src/serialize.rs:36:15

error: could not compile `aws-smithy-json` (lib) due to 3 previous errors

This fails build (ubuntu-latest, 14/15/16/17/18), clippy and docker-build. Nothing in PeerDB touches Document directly (nexus only pulls aws-config + aws-sdk-kms), so this is purely an upstream release-coordination problem — no source changes are needed, the lock just cannot be resolved this way.

Suggested fix: hold the whole aws-* group back to the versions on main (aws-smithy-types 1.6.2, aws-config 1.11.0, aws-sdk-kms 1.117.0, aws-sdk-sso 1.108.0, aws-sdk-ssooidc 1.110.0, aws-sdk-sts 1.113.0, plus the matching aws-runtime/aws-sigv4/aws-smithy-*/aws-types entries) until upstream ships an aws-config that depends on aws-smithy-json 0.64. Either a Renovate packageRules entry pinning aws-config/aws-sdk-*/aws-smithy-*, or reverting just the AWS chunk of this lock, works.

[claude]

This line is the root of the breakage flagged above: aws-config 1.12.0 (published 2026-09-04) still depends on aws-smithy-json 0.63.0 / aws-smithy-schema 0.2.0, while aws-sdk-kms 1.119.0, aws-sdk-sso 1.110.0, aws-sdk-ssooidc 1.112.0 and aws-sdk-sts 1.115.0 (all published 2026-09-14) moved to aws-smithy-json 0.64.0 / aws-smithy-schema 0.3.0.

The two aws-smithy-json majors then share a single unified aws-smithy-types 1.7.0, and 0.63.0 does not compile against it. aws-config 1.12.0 is currently the newest published version on crates.io, so there is no forward fix available yet — the AWS SDK crates need to stay on the main set for now.

[claude]

Advisory (non-blocking): zod 4.4.3 → 4.5.4 crosses a minor with documented breaking changes. The one that reaches this repo is that string .min() / .max() / .length() now count Unicode code points instead of UTF-16 code units.

All four zod schema files (app/peers/create/[peerType]/schema.ts, app/mirrors/create/schema.ts, app/alert-config/validation.ts, components/PeerForms/Eventhubs/schema.ts) use string .min()/.max() for peer-config field limits (hosts, usernames, passwords, dataset IDs, …). For input containing astral-plane characters these bounds are now effectively more permissive than before — e.g. a 60-emoji password now passes .max(100) where it previously failed at 120 UTF-16 units. These are client-side UX guards rather than the authoritative limits, so practical impact is low, but worth knowing if any backend field has a hard byte/char cap.

The other 4.5.0 breaking changes do not apply here: no z.iso.datetime(), z.record(), z.intersection() or .length() usage anywhere in ui/, and the zod/v4 subpath these files import is still exported by 4.5.4. Build & Test UI and the linters pass.

[claude]

Renovate lock-file-maintenance review

Reviewed per .claude/REVIEW.md — upstream release notes and commit logs checked for the bumped ranges in both nexus/Cargo.lock and ui/package-lock.json. Three inline comments posted.

Blocking

The nexus/Cargo.lock refresh does not compile. build (ubuntu-latest, 14–18), clippy and docker-build all fail with error: could not compile aws-smithy-json (lib). Root cause is an upstream AWS SDK release-coordination bug, not anything in PeerDB — see the inline comments on nexus/Cargo.lock lines 610 and 225. The AWS crates need to be held back to the main set until upstream ships an aws-config that depends on aws-smithy-json 0.64.

The UI side is clean: Build & Test UI, Run UI linters, ESLint and Prettier all pass.

Security fix worth calling out

next 16.3.2 → 16.3.4 picks up the 16.3.3 security release, which fixes two unauthenticated RCEs: one on Windows-hosted servers, and one in the Image Optimization API via AVIF files. The image one is not reachable here (ui/next.config.js sets images.unoptimized: true), but the Windows one is a real fix. 16.3.4 re-enables AVIF optimization that 16.3.3 had disabled as mitigation — also a no-op for us given unoptimized: true. 16.3.4 otherwise only fixes testmode fetch recursion, TS aliasing, and Turbopack crossOrigin manifests.

Behaviour changes reviewed, no regressions found

• aws-config 1.12.0 enables automatic clock-skew correction by default: when client/service clock offset exceeds 4 minutes the SDK re-signs and retries. This changes behaviour for the KMS calls in nexus/catalog, but it is a resilience improvement. Opt-out is AWS_DISABLE_CLOCK_SKEW_CORRECTION.
• aws-smithy-types 1.7.0 gives Blob a Display impl rendering lowercase hex instead of a byte-array debug dump. No PeerDB code logs KMS blobs, so no new secret exposure — flagging only because the SDK own tracing output for KMS ciphertext/plaintext becomes more directly decodable at DEBUG level.
• zod 4.4.3 → 4.5.4 has real breaking changes; only the code-point-vs-UTF-16 length counting reaches this repo. Details inline on ui/package-lock.json.
• webpack 5.109.2 → 5.110.3 moves optimization.minimize options into a separate minimizeOptions field. No impact — ui/next.config.js has no custom webpack config and nothing in ui/ imports webpack directly.
• mysql_async 0.37.1 and rust_decimal 1.43.0 both drop their rkyv 0.7 feature, which is why rkyv, rkyv_derive, bitvec, funty, radium, tap, wyz, rend, bytecheck, ahash 0.7, hashbrown 0.12, syn 1.0 and simdutf8 fall out of the tree. Pure dependency cleanup. rust_decimal 1.43.0 also fixes a missing negative sign in array_string.
• rustls 0.23.45, zstd-sys 2.1.0 (still bundles zstd 1.5.7), smallvec 1.16.1, tinyvec 1.13.3, quinn 0.11.12 — patch/minor, no API impact on nexus.
• sharp 0.35.4, terser 5.51.2, protobufjs 8.8.0, @bufbuild/protobuf 2.14.1, typescript-eslint 8.70.0, less 4.9.1, minimizer-webpack-plugin 5.10.0 — routine bug fixes.
• postcss 8.5.23 moved from next/node_modules/ to top level: same version, npm hoisting only. Dropping jiti is safe — it is an optional ESLint peer only needed for TypeScript-based configs, and ui/eslint.config.mjs is ESM.

No new stdout/stderr/log output and no PII or secret handling changes in this diff (lock files only).

[github-actions]

🔄 Flaky Test Detected

Analysis: All 12 failures are the identical ~61s "UNEXPECTED STATUS TIMEOUT STATUS_SNAPSHOT" timeout spread across six unrelated e2e suites on a single matrix leg (pg17/ch-stable) while the other two legs passed the same commit, pointing to snapshot-worker starvation on an overloaded CI runner rather than a code defect in this Renovate lockfile PR.
Confidence: 0.9

✅ Automatically retrying the workflow

View workflow run

[github-actions]

🔄 Flaky Test Detected

Analysis: All 11 failures in one matrix leg are the same 60s "UNEXPECTED STATUS TIMEOUT STATUS_SNAPSHOT" deadline in SetupCDCFlowStatusQuery, spread across four unrelated source connectors while the other two legs passed on identical code — a resource-contention timeout on a lockfile-only Renovate PR, not a regression.
Confidence: 0.88

✅ Automatically retrying the workflow

View workflow run

[ilidemi]

Going to try and keep this to UI to not get blocked on Rust

[claude]

Security-positive bump, but a newer patch now exists.

16.3.3 was a security release fixing two critical advisories:

• Unauthenticated RCE on Windows-hosted servers
• Unauthenticated RCE in the Image Optimization API when AVIF files are used

16.3.4 is the follow-up that re-enables AVIF image optimization, plus three backported fixes (testmode fetch infinite recursion, build error when aliasing typescript, unset crossOrigin in Turbopack manifests). Neither RCE path is reachable here anyway — ui/next.config.js sets images: unoptimized: true and we ship Linux containers — but the bump is still worth taking.

⚠️ 16.3.5 was released 2026-09-11, after this PR was cut (2026-09-07). It adds "Add CSP nonce to script tags of loading and template files" (#98403), next/image disk-cache hardening (skip/reject 0-byte and empty cache entries), and a use cache prerender-signal fix. Worth ticking the rebase checkbox so the lock lands on 16.3.5 rather than 16.3.4.

(@next/env, @next/eslint-plugin-next, eslint-config-next and all ten @next/swc-* binaries move 16.3.2 -> 16.3.4 in lockstep, so a rebase moves them together.)

[claude]

Highest-regression-risk bump in this PR — a minor that carries documented breaking behavior changes. I checked each one against our schemas; none of them bite, but they are worth recording.

zod 4.5.0 breaking changes:

1. .min() / .max() / .length() now count Unicode code points instead of UTF-16 code units
2. z.iso.datetime() rejects minute-precision input such as 2020-01-01T06:15Z
3. A record's key schema now governs only the keys that match it
4. __proto__ is always stripped from objects/records; .strict() reports it as unrecognized_keys
5. Stricter z.ipv6(), z.ulid(), z.httpUrl(), z.emoji()
6. Numeric enum .options excludes reverse mappings
7. Error maps now run on first error read, not at parse time

Against the four files that use zod (app/peers/create/[peerType]/schema.ts, app/mirrors/create/schema.ts, app/alert-config/validation.ts, components/PeerForms/Eventhubs/schema.ts):

• (2), (5), (6) — not applicable. We use z.url() (unchanged; only z.httpUrl() picked up the RFC 1035 hostname rule), z.enum(), z.literal(), z.record(). No z.iso.*, no ipv6/ulid/emoji, and no .options access on a zod enum.
• (3) — z.record(z.string(), ehSchema) uses a plain string key schema, so "only the keys that match it" is a no-op.
• (4) — only observable if a user names an Event Hub literally __proto__; stripping it is strictly safer.
• (7) — our error: (issue) => ... callbacks are pure functions of issue.input, so lazy evaluation is unobservable.
• (1) — the one real behavior delta. .max(100) / .max(255) / .max(64) on host / user / password / staging-path fields now count code points, so a value containing astral-plane characters (e.g. emoji in a password) counts as fewer characters than before. That is more permissive, never more restrictive — no validation that used to pass can start failing.

Net: safe to take, and it picks up real wins — ~9x smaller schema memory footprint, ~7.5x faster safeParse() failure paths (no eager stack capture), and a fix for recursive schemas retaining parsed input indefinitely.

[claude]

Feature minor, not a patch — flagging even though the blast radius here is nil.

5.110.0 is a large release: new performance hints (duplicate packages, circular dependencies), output.copy, externalsPresets.nodeModules, CSS/HTML minification under optimization.minimize, output.environment.topLevelAwait, CommonJS tree-shaking, and a built-in scope analyzer replacing eslint-scope — that last one is why webpack/node_modules/eslint-scope@5.1.1 and estraverse@4.3.0 disappear from this lockfile.

That minor did shake out real regressions: three patches in five days (5.110.1 -> 5.110.3) fixing ESM/CommonJS interop for require() outside concatenation, mangled exports read through require(), new on wrapped CommonJS default imports, deferred namespace evaluation for async modules, and a snapshot.managedPaths regex performance bug. 5.110.3 is the settled build, so this is the right version to land on rather than 5.110.0.

Risk to this repo is effectively zero regardless: webpack and copy-webpack-plugin are devDependencies with no webpack.config.js, no webpack() hook in ui/next.config.js, and nothing under ui/ importing webpack. Next 16 builds with its own bundled toolchain.

Related entry in this diff: minimizer-webpack-plugin 5.6.1 -> 5.10.0, a transitive dep of webpack (range ^5.7.0). 5.10.0 errors if both the legacy minimizerOptions/generatorOptions form and the new inline form are supplied — we never configure it, so no impact.

[claude]

Security-positive. 8.8.0 is mostly parser hardening, which matters here because the UI decodes protobuf coming back from the flow API:

• ProtoJSON and text-format parsing hardened against malformed input
• Any.fromObject recursion depth now bounded (stack overflow / DoS on deeply nested input)
• Decoder now respects declared field lengths
• Symbol visibility preserved during code generation

Feature side is Edition 2026 support. No documented breaking changes. @bufbuild/protobuf 2.14.0 -> 2.14.1 (patch) rides along in this diff.

[claude]

Lock-file maintenance review

Reviewed per .claude/REVIEW.md. A lockfile can't introduce stdout/stderr/log output, so this was a dependency-regression review: upstream release notes and commit logs read for every non-trivial bumped range.

Scope: 76 package entries changed, all resolved from registry.npmjs.org with sha512- integrity hashes. No alternate registries, no git/tarball URLs, no credentials anywhere in a resolved URL. No new top-level packages.

Structural changes — all benign:

• jiti@2.7.0 dropped. It was only an optional peer dependency of eslint; ui/eslint.config.mjs is .mjs, not .ts, so jiti was never loaded.
• next/node_modules/postcss hoisted to top-level postcss — same version (8.5.23), no top-level postcss existed before, so this is a pure dedupe.
• webpack/node_modules/eslint-scope@5.1.1 and estraverse@4.3.0 dropped — webpack 5.110.0 replaced eslint-scope with a built-in scope analyzer.

Reviewed in detail (see line comments):

Package	Change	Assessment
next (+ 13 sibling packages)	16.3.2 -> 16.3.4	Picks up two critical RCE fixes from 16.3.3. 16.3.5 now exists — rebase suggested
zod	4.4.3 -> 4.5.4	Minor with 7 breaking behavior changes; all verified non-impacting against our 4 schema files
webpack	5.109.2 -> 5.110.3	Feature minor; 5.110.3 is the settled patch. Unused as a direct dep here
protobufjs	8.7.2 -> 8.8.0	Security-positive parser hardening

Also checked, no concerns: terser 5.50.0 -> 5.51.2 (5.51.2 reverts the 5.51.0 ambiguous-default-arg change, net effect is the ?? boolean-operator fix plus a dynamic-import-args transform fix); sharp 0.35.3 -> 0.35.4 with libvips 1.3.3 (resize/composite coordinate bounds, palette bit depth, stream handling — and images: unoptimized means Next never invokes it); @typescript-eslint 8.67.0 -> 8.70.0; serialize-javascript 7.1.0 -> 7.1.1; string.prototype.matchall 4.0.12 -> 4.1.0; less 4.9.0 -> 4.9.1; js-yaml 4.3.1 -> 4.3.2; @jridgewell/sourcemap-codec 1.5.5 -> 1.6.0; plus routine browser-data refreshes (caniuse-lite, electron-to-chromium, browserslist, baseline-browser-mapping, node-releases).

Verdict: no regressions found that affect this codebase, and the bump is net-positive on security. CI is green — Build & Test UI, Run UI linters, ESLint, Prettier, CodeQL all pass. The only actionable item is the optional rebase to pull in next@16.3.5.