[ak5]

Summary

Integrate the eight open Dependabot proposals on top of the security audit: Hyper 1.12.0, serde_json 1.0.154, zeroize 1.9.1, Tokio 1.54.1, KeePass 0.17.0, the Rust 1.99.1 build image, the Python 3.15.0 image digest, and setup-python 7.1.0.

Motivation and scope

The original branches predate the audit and include a KeePass manifest conflict. This integration preserves the audit's test-util and explicit ChaCha zeroization features, combines the dependency changes, and verifies them together. Dependabot's proposals are retained with co-author attribution. Supersedes #85, #87, #88, #91, #92, #93, #94, and #95; close those only after this PR merges.

Security impact

• Trust boundary changed: no
• Credential flow changed: no
• Threat model updated or not required: not required; dependency and build pins only. KeePass remains read-only in production, with save support restricted to development fixtures.

Documentation

• Repository conventions distinguish the Rust 1.99.0 local/CI minimum check from the patched 1.99.1 container compiler. Historical audit evidence remains unchanged.
• Relative Markdown file links checked; no broken links.

Verification

• mise run check, sequential at reduced CPU priority, including the exact pinned Hermes source.
• mise run e2e: connected synthetic two-password KDBX/admin/Telegram/proxy/API flow and isolated Chrome passkey UI.
• Real Telegram, production credentials and k3s were not used. Container builds are checked by CI.

Risk and rollback

• Risk: dependency behavior can change despite compatible APIs; regression suites cover credential handling, request framing, TLS and response mediation. The combined updates need green CI before merge.
• Rollback: revert this integration and redeploy the preceding immutable main image. No KDBX, passkey or policy migration is performed.