[shikhar]

Brings dependencies up to date and removes some duplicate crates from the graph. Each change is a separate commit so it can be dropped on its own.

• Lockfile: cargo +nightly update, which respects the 3-day minimum publish age in .cargo/config.toml. It updates 29 packages, all patch or minor releases: AWS SDK and Smithy crates (aws-sdk-s3 1.158.0, aws-smithy-runtime-api 1.21.0), syn, uuid, jiff, flate2, and others. bitflags 1.x and the defmt crates drop out of the graph.
• axum-server 0.8.0 → 0.9.2: no code changes needed, and no new deprecations. 0.9 fixes graceful shutdown cancelling in-progress TLS handshakes. Its tls-rustls feature now enables TLS 1.2, but aws-smithy-http-client already enabled that through hyper-rustls, so the TLS versions the server accepts don't change. 0.9.1 was yanked.
  • 0.9.2 was published 2026-11-11, inside the cooldown, so it is listed in .github/dependency-cooldown/exceptions.toml. The 0.9.2 crate has no build script and uses #![forbid(unsafe_code)]. The exception can be removed after 2026-11-14.
• prometheus: drop the default protobuf feature, since only the text encoder is used. This removes protobuf, protobuf-support, and the duplicate thiserror 1.x. disk_block_fits_its_full_pages checks the encoded metrics text and still passes.

cargo deny reports 18 duplicate crates, down from 20. The remaining ones come from crates that are already at their latest release, plus our own choice of parking_lot 0.13 from #215.

cargo deny check, clippy with warnings denied, rustfmt, the dependency cooldown check, and cargo nextest run --locked --all-features (206 passed, 1 skipped) all pass.

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Updates dependencies, upgrades axum-server to 0.9.2, and removes the unused prometheus protobuf feature.

• Cachey’s HTTPS server lets ongoing TLS handshakes finish during shutdown.
• Prometheus keeps text metrics without its protobuf encoder.
• Cachey builds against newer versions of its AWS and Rust dependencies.

_{Reviews (1) · Last reviewed commit: "chore(deps): drop prometheus's default p..." · Reviewed by Greptile}