Lock file maintenance

[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

Renovate lock-file maintenance review — no findings

Reviewed both lockfiles (nexus/Cargo.lock, ui/package-lock.json) against .claude/REVIEW.md. No source, logging, or config changes, so the PII/secret-logging criterion is N/A. I read the upstream release notes for every non-trivial bump; nothing looks like a regression risk. Details below for the record.

Worth landing for

next 16.3.2 → 16.3.3 is a critical security release. Per the release notes it fixes two unauthenticated RCE advisories:

• GHSA-p293-qw3h-jr36 — unauthenticated RCE on Windows-hosted servers
• GHSA-2xp9-vwfh-vxw4 — unauthenticated RCE in the Image Optimization API when AVIF files are used

Neither is exploitable in PeerDB as shipped: the UI runs in Linux containers, and ui/next.config.js sets images: { unoptimized: true }, which disables the Image Optimization API. (Both advisories are still private, so they do not resolve in the GitHub Advisory DB yet.) Still the strongest reason to merge this.

mysql_async 0.37.0 → 0.37.1 — fixes a data race in the statement cache (blackbeam/mysql_async#406); this is where the new arc-swap edge in Cargo.lock comes from. Directly relevant, nexus/peer-mysql depends on it.

aws-lc-rs 1.18.0 → 1.18.1 / aws-lc-sys 0.44.0 → 0.45.0 — realigns to AWS-LC v5.7.0 (from v5.5.0), which corrects EVP_DecryptUpdate for padded block ciphers so it only writes the range reported via out_len. This is the TLS backend for pgwire (server-api-aws-lc-rs), tokio-postgres-rustls, mysql_async and reqwest, so it is the one bump here with a non-zero behaviour surface: 1.18.1 also tightens AEAD / cipher-IV / HKDF / ECDH / RSA API contracts so non-conforming inputs now return Err(Unspecified) instead of proceeding. Upstream states valid inputs are unaffected, and rustls only feeds conforming inputs — plus clippy and the UI build are green. No MSRV or cmake/bindgen build-requirement change.

Notable but benign

• rust_decimal 1.42.1 → 1.43.0 — drops the rkyv 0.7 feature bridge, which is what accounts for the net −180 lines: 16 crates leave the graph (rkyv, rkyv_derive, bitvec, bytecheck(+_derive), ptr_meta(+_derive), radium, rend, simdutf8, tap, wyz, funty, ahash 0.7, hashbrown 0.12, and syn 1.0.109, now gone from the tree entirely). The one behaviour change is a fix for a missing negative sign in array_string, which nexus does not call. nexus pins default-features = false, features = ["tokio-pg"], so the rkyv/rand feature bridges were never enabled — both rand 0.8.8 and 0.9.5 now sit in the lock as unactivated optional deps, exactly as rkyv did before.
• protobufjs 8.7.2 → 8.8.0 — hardening for ProtoJSON/text-format parsing, recursion limits in Any.fromObject, decoder now respects declared lengths. Additive; the UI uses @bufbuild/protobuf directly and protobufjs is only transitive.
• zod 4.4.3 → 4.5.4 — additive only (z.compile, z.validate, z.deepPartial, new locales); no documented breaking changes across 4.5.0–4.5.4.
• webpack 5.109.2 → 5.110.2 is the largest single minor here (CJS tree-shaking, built-in HTML/CSS minification, lazy concatenated-module accessors) — but it is a devDependency, ui/next.config.js defines no webpack() hook, and Next 16 builds with Turbopack, so it is not in the build path. Same for terser 5.51.2 and minimizer-webpack-plugin 5.8.0.
• sharp 0.35.4 / @img/sharp-libvips 1.3.3 — libvips 8.18.6 with coordinate-bounds and stream-lifecycle fixes. No advisory attached.
• Remainder is routine: AWS SDK crates, smallvec 1.16.0, tinyvec 1.13.2, indexmap 2.14.2, crossbeam-*, wasm-bindgen 0.2.128, syn 3.0.5, zstd-sys 2.1.0 (bundled zstd stays 1.5.7), typescript-eslint 8.68.0, and caniuse-lite/electron-to-chromium data refreshes.

Hygiene checks

• No packages added to ui/package-lock.json; the only removals are webpack's nested eslint-scope 5.1.1 / estraverse 4.3.0.
• Every resolved URL still points at registry.npmjs.org, and every Cargo source is still registry+https://github.com/rust-lang/crates.io-index — no registry substitution.
• All resolved versions satisfy the declared ranges in ui/package.json and nexus/*/Cargo.toml; no manifest edits were needed.
• Checked the GitHub Advisory DB for webpack, sharp, protobufjs and aws-lc-sys: no advisory is newly resolved by this bump beyond the Next.js one above.

One process note: renovate/stability-days is still pending ("Updates have not met minimum release age requirement"), so this should not be force-merged past that gate.

[claude]

rust_decimal 1.42.1 → 1.43.0 — the one bump in this PR worth a closer look. Released 2026-09-02, so it is 5 days old.

Directly relevant fixes (upstream #808, a backport of #807):

• "Postgres FromSql panics on legitimate large NUMERIC values" — 10i128.pow(4 * start_integers) overflowed for weights ≥ 11 (i.e. 10^44). It now uses checked_pow and returns ExceedsMaximumPossibleValue instead of panicking. nexus/peer-postgres/src/stream.rs:153 (let numeric: Option<Decimal> = row.get(i)) goes through exactly that FromSql path, so this bump removes a real panic on wide PG NUMERIC. Worth confirming the new Err surfaces as a query error rather than being swallowed.
• from_str no longer silently ignores non-digit garbage after the 29th significant digit (now InvalidCharacter / DuplicatedDecimalPoint). Long-but-valid digit strings are unaffected, so nexus/peer-bigquery/src/stream.rs:150 (Decimal::from_str(&result)? for NUMERIC/BIGNUMERIC) should behave the same.

Regression risk to be aware of:

• Upstream #809 rewrote the hot arithmetic paths: u128 fast paths for 64-bit mul/add/sub, rescale_internal scaling in chunks of up to 9 digits instead of one at a time, truncate_internal reporting discarded fractions so floor/ceil truncate once, and PartialEq short-circuiting on identical bit patterns. The author states rounding semantics are preserved, but this is a fresh rewrite of the code that rescales and renders every Value::Numeric nexus emits.
• adding IF NOT EXISTS for pg and bq #808 also carries "math precision improvements" that shift division and ln results by 1–2 ULP, with several upstream test expectations updated. Nexus transports decimals rather than computing on them, so this is unlikely to bite — but a numeric-heavy e2e pass (PG NUMERIC, BigQuery NUMERIC/BIGNUMERIC) before merge would be cheap insurance on a 5-day-old release.

Side benefit: dropping the rkyv 0.7 feature bridge (#819) removes rkyv, rkyv_derive, bitvec, bytecheck, ptr_meta, radium, rend, simdutf8, tap, wyz, ahash 0.7, hashbrown 0.12 and the last syn 1.0.109 from the tree. No functional impact, since nexus builds this crate with default-features = false, features = ["tokio-pg"].

[claude]

next 16.3.2 → 16.3.3 is a security release — flagging so this does not sit unmerged. Per the v16.3.3 notes it fixes two advisories, both rated critical:

• GHSA-p293-qw3h-jr36 — unauthenticated RCE on Windows-hosted servers
• GHSA-2xp9-vwfh-vxw4 — unauthenticated RCE in the Image Optimization API when AVIF files are used

Actual exposure for the PeerDB UI looks low on both counts: it ships in a Linux container (not Windows-hosted), and ui/next.config.js:17-19 sets images: { unoptimized: true }, which takes the Image Optimization API out of the picture. No regression risk in the bump itself — the release lists no other changes.

[claude]

webpack 5.109.2 → 5.110.2 — the refresh stopped one patch short. 5.110.3 was published 2026-09-01, six days before this lock was regenerated (branch commit dated 2026-09-07). It is currently latest on npm, not deprecated, and still engines: node >=10.13.0, so ^5.99.7 should have resolved to it. A rebase/retry may be worth a shot to see whether Renovate picks it up.

It matters a little because 5.110.0 (2026-08-27) is a substantial minor — it wraps concatenated modules in lazy __webpack_require__.cw accessors and inlines require() (#21519) — and .1/.2/.3 are all regression fixes layered on that rework. 5.110.3 specifically fixes import() options, ESM interop when require() targets a module outside the concatenation, concatenated require() inside a require.ensure callback, mangled exports read through require(), and new on a default import of a wrapped CommonJS module. It also reverts optimization.minimize to a boolean (options moving to minimizeOptions) after 5.110.1 had loosened it.

Mitigating: this entry is dev: true, and nothing under ui/ references webpack outside package.json — next.config.js has no webpack() hook, so it is not on the Next build path. Low practical risk either way; noting it mainly because "lock file maintenance" implies a full refresh.

[claude]

mysql_async 0.37.0 → 0.37.1 — patch release whose only listed change is "Fix data race in statement cache" (upstream issue #406). The new arc-swap dependency appearing in this same hunk is that fix. Straightforwardly good for nexus/peer-mysql; no behavior change to review.

[claude]

rustls 0.23.43 → 0.23.44 — three changes, two worth noting, one of which lands squarely on the "do not leak secrets" rule in .claude/REVIEW.md:

• KeyLogFile now creates the SSLKEYLOGFILE with owner-only permissions (#3210). Previously those TLS session keys were written world-readable.
• Server certificates are now verified against the correct name on ECH rejection (#3236).
• Default flip: ML-DSA post-quantum certificates are now enabled by default in the aws-lc-rs provider (#3249). Nexus reaches that provider via pgwires server-api-aws-lc-rs feature (nexus/Cargo.toml:35). ML-DSA is not in the public web PKI, so this only widens what a private CA hierarchy may present — no expected impact, but it is a default changing inside the TLS stack.

[claude]

aws-lc-rs 1.18.0 → 1.18.1 / aws-lc-sys 0.44.0 → 0.45.0 — the 1.18.1 notes tighten several API contracts so inconsistent inputs now fail closed with Err(Unspecified) instead of being accepted (#1215): in-place AEAD sealing verifies Extend produced exactly enough space, streaming cipher constructors reject missing/mismatched IV contexts, RSA verify_digest_sig requires the supplied digest to match RsaParameters, and Salt::from(Okm) now uses the Okms output algorithm rather than the source PRKs. Upstream states valid inputs are unaffected, and nexus only consumes this transitively through rustls/pgwire, so it should be a no-op here.

aws-lc-sys 0.45.0 moves the vendored AWS-LC from v5.5.0 to v5.7.0, which corrects EVP_DecryptUpdate for padded block ciphers so it only modifies the output range reported through out_len. Since this is the C-compiling sys crate, it is also the bump most likely to affect the nexus image build — the release includes a fix for -Wa,--debug-prefix-map under Clang + LTO (now using -ffile-prefix-map) and CFLAGS filtering for jitterentropy, so worth an eye on the Rust build job and not just the tests.

[claude]

protobufjs 8.7.2 → 8.8.0 — hardening release, no API break. All three fixes are on the decode path: "Harden ProtoJSON and Text Format parsing" (#2418), "Limit Any.fromObject recursion" (#2419), and "Respect declared lengths while decoding" (#2420). The minor bump itself is Edition 2026 support (#2414), which is additive. Good to take.

[claude]

zod 4.4.3 → 4.5.4 — a minor, but nothing in this range changes default behavior.

4.5.0s headline is z.compile(), which walks a schema and emits flat JS executed via new Function(). It is strictly opt-in — nothing auto-compiles unless global auto-compilation is turned on — so it introduces no new unsafe-eval requirement for the UIs CSP as long as it is not adopted. The rest of the 4.5.x line is fixes: 4.5.4 stops the cycle walk from firing a default factory (#6500), 4.5.3 emits record numeric keys as strings in toJSONSchema (#6497), 4.5.2 lets a prototype-method getter answer a bare call so vi.spyOn works (#6488).

That last one is the only thing I would sanity-check: the advertised 9x schema-memory reduction comes from lazy-bound methods, and if any UI code pulls a schema method off the instance and calls it detached, that is where it would show up. The genuinely breaking changes in this range (.merge() throwing when the receiver has refinements, base64 rejecting whitespace, stricter HTTP URL validation) all landed in 4.4.0, which main is already on.

[claude]

terser 5.50.0 → 5.51.2 — minifier semantics moved across this range, so noting it even though the blast radius here looks nil. 5.51.0 deoptimizes ("pins") functions whose argnames scope is ambiguous — default arguments referencing other parameters or outer variables — and fixes ?? being misclassified as a boolean operator, which was generating booleans on its left-hand side. 5.51.1 fixes code transformation inside dynamic import() arguments, and 5.51.2 then reverts part of the argname pinning due to "issues that came up without clear reproduction". Three releases of churn in a minifier.

Only reachable transitively through webpacks minimizer-webpack-plugin (also bumped here, 5.6.1 → 5.8.0), and webpack is not on the Next build path for this UI, so I would expect no effect on shipped output.