Update deps

.cargo/config.toml

@@ -0,0 +1,6 @@
+# Hold back registry crate versions younger than a week.
+# A malicious or broken release is usually yanked within that window, before the resolver can pick it. Versions
+# already in Cargo.lock are kept. For an urgent bump, such as a security fix, run
+# `CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update -p <crate> --precise <version>`.
+[registry]
+global-min-publish-age = "7 days"

.mise/config.dart.toml

@@ -42,6 +42,9 @@ run = "dart pub get"
 [tasks.dart-check]
 depends = ["dart-pub-get"]
 run = "dart analyze {{ vars.dart_paths }}"
+# Wait for gen-specs, whose gen:dart-rest deletes and rebuilds the `.g.dart` parts while it runs build_runner.
+# `wait_for` rather than `depends`: the edge only matters when `check` has scheduled both.
+wait_for = ["gen-specs"]
 
 [tasks.dart-fix]
 depends = ["dart-pub-get"]
@@ -57,6 +60,9 @@ depends = ["dart-pub-get"]
 # Parallel of cargo-fmt-check: fail if any tracked Dart source would be reformatted.
 # This lets CI enforce the same formatting `dart-fmt` applies.
 run = "dart format --output=none --set-exit-if-changed {{ vars.dart_paths }}"
+# Wait for gen-specs, whose gen:dart-rest writes generated/dart-rest unformatted before it runs `dart format`.
+# `wait_for` rather than `depends`: the edge only matters when `check` has scheduled both.
+wait_for = ["gen-specs"]
 
 # Namespaced aggregators picked up by the default config's globbed `check`/`fmt`.
 [tasks."check:dart"]

.mise/config.python.toml

@@ -82,11 +82,14 @@ RUFF_CACHE_DIR = "{{ config_root }}/target/ruff-cache"
 # It honours .gitignore (so target/ is skipped) and ruff.toml's `exclude`/`extend-exclude`. Every tracked *.py
 # already lives under a dir we want linted, so discovery covers them without an explicit include list -- scope
 # is narrowed by excludes only.
-pyrefly-check = "pyrefly check -c config/pyrefly.toml"
-ruff-check = "ruff check"
+#
+# Each check waits for gen-specs, whose gen:python-* rewrite the generated clients and then ruff-fix them.
+# `wait_for` rather than `depends`: the edge only matters when `check` has scheduled both.
+pyrefly-check = { run = "pyrefly check -c config/pyrefly.toml", wait_for = ["gen-specs"] }
+ruff-check = { run = "ruff check", wait_for = ["gen-specs"] }
 ruff-fix = "ruff check --fix"
 ruff-fmt = "ruff format"
-ruff-fmt-check = "ruff format --check"
+ruff-fmt-check = { run = "ruff format --check", wait_for = ["gen-specs"] }
 
 # Namespaced aggregators picked up by the default config's globbed tasks.
 # Those are its `check`/`fmt`/`test`.

.mise/config.toml

@@ -55,6 +55,9 @@ java.shorthand_vendor = "openjdk"
 # `mise lock --bump` re-resolves the `latest` selectors when a deliberate tool refresh is wanted.
 lockfile = true
 lockfile_platforms = ["linux-arm64", "linux-x64", "macos-arm64", "macos-x64", "windows-x64"]
+# Hide tool releases younger than a week, so a malicious or broken release is usually pulled before it resolves.
+# mise's own default is a day. Cargo holds crates back by the same age.
+minimum_release_age = "7d"
 task.run_auto_install = false
 # Hard-verify tool signatures via gpg on every platform.
 # Propagates to node.gpg_verify and swift.gpg_verify per mise/src/config/settings.rs. mise's node plugin
@@ -240,6 +243,10 @@ zizmor = "latest"
 # headers below).
 [[tools.rust]]
 components = "clippy,rust-analyzer"
+# Waive the release age, so `stable` is the rustup channel's stable as it is on Windows.
+# Held back by a week, `stable` resolved to the previous release, whose cargo ignores `global-min-publish-age`
+# and so dropped cargo's own cooldown, and Linux/macOS then lagged the Windows `stable-<host>` entries.
+minimum_release_age = "0"
 os = ["linux", "macos"]
 profile = "minimal"
 targets = "riscv32imac-unknown-none-elf,thumbv8m.main-none-eabihf,wasm32-unknown-unknown,wasm32-wasip2,wasm32v1-none"
@@ -1278,6 +1285,9 @@ usage = 'arg "[file]..." var=#true help="Rust files to reflow (default: every tr
 
 [tasks.cargo-fmt-check]
 run = "cargo +{{ vars.rust_nightly }} fmt -- --check"
+# Wait for gen-specs, whose gen:ws-spec writes generated/rust-rest unformatted before it runs `cargo fmt` on it.
+# `wait_for` rather than `depends`: the edge only matters when `check` has scheduled both.
+wait_for = ["gen-specs"]
 
 [tasks.cargo-clippy-check]
 alias = ["cargo-clippy", "clippy", "clippy-check"]
@@ -1398,7 +1408,8 @@ description = "Run conftest OPA/Rego policies over the TOML config + lock files"
 # combined TOML input.
 run = """
 ns_list="cross cargo mise mise_lock pyproject checksums advisories"
-named="Cargo.lock config/cargo-features.toml config/upstream-cache/data.toml config/deny.toml config/pyrefly.toml"
+named=".cargo/config.toml Cargo.lock config/cargo-features.toml config/upstream-cache/data.toml config/deny.toml"
+named="$named config/pyrefly.toml"
 # Both lists rely on word-splitting when they expand.
 # $ns expands to repeated `--namespace <n>` pairs; $named is a space-separated path list.
 # shellcheck disable=SC2086

.mise/config.zig.toml

@@ -93,6 +93,9 @@ llvm_mingw_pattern = """{% raw %}llvm-mingw-*-ucrt-
 
 [tasks.zig-check]
 run = "zig fmt --check modules/ libs/zig-shared/ generated/zig-rest/"
+# gen:zig-rest writes the client raw and only then zig-fmts it, so a check alongside gen-specs can read it unformatted.
+# `wait_for` rather than `depends`: the edge only matters when `check` has scheduled both.
+wait_for = ["gen-specs"]
 
 [tasks.zig-fmt]
 run = "zig fmt modules/ libs/zig-shared/ generated/zig-rest/"

.mise/locks/mise.js/npm-asyncapi-generator/3.5.0~39db1ca7/aube-lock.yaml

@@ -1027,8 +1027,8 @@ packages:
     resolution: {integrity: sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==}
     engines: {node: '>=8'}
 
-  ansi-regex@6.6.0:
-    resolution: {integrity: sha512-XZ5apbzreCbXSKwPjJstu8R0zOi247w3XYwWxtwBXgpZrCyc1Ka7p9/xY0A9/diMewmHbEKz+FIraWaEWjlN5g==}
+  ansi-regex@6.5.0:
+    resolution: {integrity: sha512-zhvbbbdt1kbw7EJ9OQoxmQcuaNR9P5kTj7e/YdmOSU10aHWbycofJxA6jKfoEy3vlLdctOF9ZHaxLtmSm998wQ==}
     engines: {node: '>=12'}
 
   ansi-styles@4.3.0:
@@ -1162,8 +1162,8 @@ packages:
     resolution: {integrity: sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==}
     engines: {node: '>=18'}
 
-  ci-info@4.5.0:
-    resolution: {integrity: sha512-d1uM8k5UZEyPza1n/MG3ko8nKupKN0KJpFsipgPcgaCCvV+IqIfJ+NzTjetlLM+UcXZx3+cLrNr76+eAO7G1Mw==}
+  ci-info@4.4.0:
+    resolution: {integrity: sha512-77PSwercCZU2Fc4sX94eF8k8Pxte6JAwL4/ICZLFjJLqegs7kCuAsqqj/70NQF6TvDpgFjkubQB2FW2ZZddvQg==}
     engines: {node: '>=8'}
 
   cliui@8.0.1:
@@ -1228,6 +1228,11 @@ packages:
     resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
     engines: {node: '>= 8'}
 
+  cssesc@3.0.0:
+    resolution: {integrity: sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==}
+    engines: {node: '>=4'}
+    hasBin: true
+
   data-view-buffer@1.0.2:
     resolution: {integrity: sha512-EmKO5V3OLXh1rtK2wgXRansaK1/mtVdTUEiEI0W8RkvgT05kfxaH29PliLnpLP73yYO6142Q72QNa8Wx/A5CqQ==}
     engines: {node: '>= 0.4'}
@@ -2033,8 +2038,8 @@ packages:
   package-json-from-dist@1.0.1:
     resolution: {integrity: sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==}
 
-  pacote@21.5.3:
-    resolution: {integrity: sha512-XAHnxRzERPW/Y3sLaCgfUVdfP5Di1K0wiUWsDaK4reodu20Kl0pVZcw8Mdd2LaLsUpot6YLVOEgmIqMEL9Tjog==}
+  pacote@21.5.2:
+    resolution: {integrity: sha512-rifBXawDMv3nLvABWr1kTpSk0UjeglTT4Vt9t8nU9xSnfdZcCTy+FOjO6TgXWAS77lIfbZlRkl2eKQcdY0++jA==}
     engines: {node: ^20.17.0 || >=22.9.0}
     hasBin: true
 
@@ -2104,8 +2109,8 @@ packages:
     resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==}
     engines: {node: '>= 0.4'}
 
-  postcss-selector-parser@7.2.0:
-    resolution: {integrity: sha512-Khh/tERVBn0I1499dvBSHY0pWJloMJWUxDsOBM0CCDPAcVZ10Jl2L1qy1f19uEX22spa8Mv7DCdEQJc0cGwBhQ==}
+  postcss-selector-parser@7.1.7:
+    resolution: {integrity: sha512-wWBro/7hJ40ye6TPiXkUQoXKCw23xSsjriUvqd7Uls9Sso3oLiON1flc18cCdnjgCRXw4fBVqUJJeOdDTh3P3g==}
     engines: {node: '>=4'}
 
   proc-log@4.2.0:
@@ -2780,6 +2785,7 @@ snapshots:
       - '@swc/core'
       - '@swc/wasm'
       - '@types/babel__core'
+      - '@types/node'
       - encoding
       - supports-color
 
@@ -3742,7 +3748,7 @@ snapshots:
       npm-package-arg: 13.0.2
       npm-pick-manifest: 11.0.3
       npm-registry-fetch: 19.1.1
-      pacote: 21.5.3
+      pacote: 21.5.2
       parse-conflict-json: 5.0.1
       proc-log: 6.1.0
       proggy: 4.0.0
@@ -3759,7 +3765,7 @@ snapshots:
     dependencies:
       '@npmcli/map-workspaces': 3.0.6
       '@npmcli/package-json': 5.2.1
-      ci-info: 4.5.0
+      ci-info: 4.4.0
       ini: 4.1.3
       nopt: 7.2.1
       proc-log: 4.2.0
@@ -3816,7 +3822,7 @@ snapshots:
     dependencies:
       cacache: 20.0.4
       json-parse-even-better-errors: 5.0.0
-      pacote: 21.5.3
+      pacote: 21.5.2
       proc-log: 6.1.0
       semver: 7.8.6
     transitivePeerDependencies:
@@ -3858,7 +3864,7 @@ snapshots:
 
   '@npmcli/query@5.0.0':
     dependencies:
-      postcss-selector-parser: 7.2.0
+      postcss-selector-parser: 7.1.7
 
   '@npmcli/redact@4.0.0': {}
 
@@ -4128,7 +4134,7 @@ snapshots:
   agent-base@7.1.4: {}
 
   ajv-draft-04@1.0.0(ajv@8.20.0):
-    dependencies:
+    optionalDependencies:
       ajv: 8.20.0
 
   ajv-errors@3.0.0(ajv@8.20.0):
@@ -4171,7 +4177,7 @@ snapshots:
 
   ansi-regex@5.0.1: {}
 
-  ansi-regex@6.6.0: {}
+  ansi-regex@6.5.0: {}
 
   ansi-styles@4.3.0:
     dependencies:
@@ -4343,7 +4349,7 @@ snapshots:
 
   chownr@3.0.0: {}
 
-  ci-info@4.5.0: {}
+  ci-info@4.4.0: {}
 
   cliui@8.0.1:
     dependencies:
@@ -4395,6 +4401,8 @@ snapshots:
       shebang-command: 2.0.0
       which: 2.0.2
 
+  cssesc@3.0.0: {}
+
   data-view-buffer@1.0.2:
     dependencies:
       call-bound: 1.0.4
@@ -4600,7 +4608,7 @@ snapshots:
   fastest-stable-stringify@2.0.2: {}
 
   fdir@6.5.0(picomatch@4.0.7):
-    dependencies:
+    optionalDependencies:
       picomatch: 4.0.7
 
   filename-reserved-regex@2.0.0: {}
@@ -5259,7 +5267,7 @@ snapshots:
 
   package-json-from-dist@1.0.1: {}
 
-  pacote@21.5.3:
+  pacote@21.5.2:
     dependencies:
       '@gar/promise-retry': 1.0.3
       '@npmcli/git': 7.0.2
@@ -5378,8 +5386,9 @@ snapshots:
 
   possible-typed-array-names@1.1.0: {}
 
-  postcss-selector-parser@7.2.0:
+  postcss-selector-parser@7.1.7:
     dependencies:
+      cssesc: 3.0.0
       util-deprecate: 1.0.2
 
   proc-log@4.2.0: {}
@@ -5745,7 +5754,7 @@ snapshots:
 
   strip-ansi@7.2.0:
     dependencies:
-      ansi-regex: 6.6.0
+      ansi-regex: 6.5.0
 
   strip-json-comments@2.0.1: {}
 

.mise/locks/mise.js/npm-asyncapi-markdown-template/2.0.0~34f72aac/aube-lock.yaml

@@ -2488,7 +2488,7 @@ snapshots:
   '@types/urijs@1.19.26': {}
 
   ajv-draft-04@1.0.0(ajv@8.20.0):
-    dependencies:
+    optionalDependencies:
       ajv: 8.20.0
 
   ajv-errors@3.0.0(ajv@8.20.0):