Bump axum from 0.5.17 to 0.8.9

[dependabot]

Bumps axum from 0.5.17 to 0.8.9.

Release notes

Sourced from axum's releases.

axum-v0.8.9

• added: WebSocketUpgrade::{requested_protocols, set_selected_protocol} for more flexible subprotocol selection (#3597)
• changed: Update minimum rust version to 1.80 (#3620)
• fixed: Set connect endpoint on correct field in MethodRouter (#3656)
• fixed: Return specific error message when multipart body limit is exceeded (#3611)

#3597: tokio-rs/axum#3597 #3620: tokio-rs/axum#3620 #3656: tokio-rs/axum#3656 #3611: tokio-rs/axum#3611

axum v0.8.8

• Clarify documentation for Router::route_layer (#3567)

#3567: tokio-rs/axum#3567

axum v0.8.7

• Relax implicit Send / Sync bounds on RouterAsService, RouterIntoService (#3555)
• Make it easier to visually scan for default features (#3550)
• Fix some documentation typos

#3550: tokio-rs/axum#3550 #3555: tokio-rs/axum#3555

axum v0.8.5

• fixed: Reject JSON request bodies with trailing characters after the JSON document (#3453)
• added: Implement OptionalFromRequest for Multipart (#3220)
• added: Getter methods Location::{status_code, location}
• added: Support for writing arbitrary binary data into server-sent events (#3425)]
• added: middleware::ResponseAxumBodyLayer for mapping response body to axum::body::Body (#3469)
• added: impl FusedStream for WebSocket (#3443)
• changed: The sse module and Sse type no longer depend on the tokio feature (#3154)
• changed: If the location given to one of Redirects constructors is not a valid header value, instead of panicking on construction, the IntoResponse impl now returns an HTTP 500, just like Json does when serialization fails (#3377)
• changed: Update minimum rust version to 1.78 (#3412)

#3154: tokio-rs/axum#3154 #3220: tokio-rs/axum#3220 #3377: tokio-rs/axum#3377 #3412: tokio-rs/axum#3412 #3425: tokio-rs/axum#3425 #3443: tokio-rs/axum#3443 #3453: tokio-rs/axum#3453 #3469: tokio-rs/axum#3469

axum v0.8.4

• added: Router::reset_fallback (#3320)
• added: WebSocketUpgrade::selected_protocol (#3248)
• fixed: Panic location for overlapping method routes (#3319)
• fixed: Don't leak a tokio task when using serve without graceful shutdown (#3129)

... (truncated)

Commits

• c59208c revert axum-core changelog changes
• 99068f5 Revert "Fix IntoResponse for tuples overriding error response codes (#3603)"
• 23d7098 Revert "axum-core 0.5.6"
• e8a39ad axum-macros 0.5.1
• 6e9a249 axum-extra 0.12.6
• 0ec9041 axum 0.8.9
• c3fcebb axum-core 0.5.6
• a8790fc update release notes
• 26ba7bb docs: consolidate state management docs in crate root (#3683)
• 9fc59ef Update to tokio-tungstenite 0.29 (#3689)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[ev-vaultkeeper]

Dependabot review: axum 0.5.17 → 0.8.9

Safe to merge. ✅

How axum is used

I traced every reference to axum in the repo. It is declared in crates/ev-enclave/Cargo.toml and appears in Cargo.lock, but it is not used anywhere in the source:

• grep for use axum, axum::, and extern crate axum across all *.rs files → no matches.
• A repo-wide search for axum only matches crates/ev-enclave/Cargo.toml and Cargo.lock.
• cargo tree -i axum confirms it is pulled in only by ev-enclave (→ ev-cli), and it has been an unused, declared dependency since the initial import.

Because no code references axum, the numerous breaking changes in this major bump (http 0.2→1.0, hyper 0.14→1.0, Server→axum::serve, State/Router/handler API changes, :param→{param} path syntax, async-trait removal, MSRV → 1.80) have no impact on any code path in this project.

Changelog / dependency review

• The bump modernises the transitive tree: it drops the old tower-http 0.3.5, tower 0.4.13, pin-project, and http-range-header, and aligns axum on http 1.x/hyper 1.x (which reqwest already uses). Nothing suspicious; no known security or performance concerns — if anything it retires very old 0.5-era transitive crates.

Build verification (no changes needed)

• cargo build — ✅
• cargo build --locked — ✅ (Cargo.lock consistent with Cargo.toml)
• cargo clippy — ✅ (only pre-existing, unrelated warnings in theme.rs/tty.rs/cert.rs)
• cargo test -p ev-enclave --no-run — ✅

No source changes were required, so nothing was pushed to the branch.

Optional follow-up (not blocking)

Since axum is entirely unused, a reasonable cleanup would be to remove the axum dependency from crates/ev-enclave/Cargo.toml altogether rather than keep bumping it. That is out of scope for this PR.