fix: upgrade Octocrab within the declared MSRV

.cargo/config.toml

@@ -0,0 +1,3 @@
+# Keep dependency updates within the package's declared `rust-version`.
+[resolver]
+incompatible-rust-versions = "fallback"

README.md

@@ -91,3 +91,28 @@ jobs:
 
 Any other mode (`review`, `security`, `architecture`, `performance`,
 `product`) can be invoked the same way by passing it as the `mode` input.
+
+### Dependency resolution and MSRV
+
+The review tool currently supports Rust 1.88, as declared by its package and
+verified by CI. Cargo is configured to prefer dependency versions compatible
+with that declaration during updates. The blocked Octocrab 0.54.1 proposal
+introduced this build dependency chain:
+
+```text
+octocrab 0.54.1
+└── cargo_metadata 0.23.1
+    └── cargo-platform 0.3.3 (MSRV 1.91)
+```
+
+Cargo can select `cargo-platform` 0.3.2 for Rust 1.88, but Octocrab 0.48 and
+later also require `jsonwebtoken` 10 and a JWT crypto backend even though this
+tool authenticates with the workflow token and never signs GitHub App JWTs.
+RustCrypto introduces the unpatched RUSTSEC-2023-0071 advisory; AWS-LC requires
+an additional native toolchain and fails a clean Windows build without NASM.
+
+Octocrab 0.47.1 is therefore the newest acceptable target. It retains
+`jsonwebtoken` 9, supports Rust 1.73, and builds without either extra JWT
+backend. Default features are disabled, leaving only the HTTP client, Rustls,
+and request timeouts. Raising the fleet MSRV is a separate policy decision
+tracked in issue #28, not a dependency-update side effect.

tools/ai-review/Cargo.toml

@@ -13,7 +13,7 @@ path = "src/main.rs"
 [dependencies]
 tokio   = { version = "1",    features = ["full"] }
 reqwest = { version = "0.12", features = ["json", "rustls-tls"], default-features = false }
-octocrab   = "0.44"
+octocrab   = { version = "0.47", default-features = false, features = ["default-client", "rustls", "rustls-ring", "timeout"] }
 serde      = { version = "1", features = ["derive"] }
 serde_json = "1"
 anyhow     = "1"

tools/ai-review/tests/workflow_policy.rs

@@ -85,3 +85,16 @@ fn documented_caller_is_safe_for_forks_and_stale_runs() {
     assert!(readme.contains("@<reviewed-commit-sha>"));
     assert!(!readme.contains("ai-review.yml@main"));
 }
+
+#[test]
+fn dependency_updates_respect_the_declared_msrv() {
+    let cargo_config = read_repository_file(".cargo/config.toml");
+    let manifest = read_repository_file("tools/ai-review/Cargo.toml");
+
+    assert!(cargo_config.contains("incompatible-rust-versions = \"fallback\""));
+    assert!(manifest.contains("rust-version = \"1.88\""));
+    assert!(manifest.contains("octocrab   = { version = \"0.47\""));
+    assert!(manifest.contains("default-features = false"));
+    assert!(!manifest.contains("jwt-rust-crypto"));
+    assert!(!manifest.contains("jwt-aws-lc-rs"));
+}