## Dependency updates (exact pins)
- tokio 1.53.2, tokio-util 0.7.20, hyper 1.12.0, serde_json 1.0.154,
uuid 1.28.0, toml 1.1.8, opendal 0.59.4, ammonia 4.2.3, config 0.15.27,
http-acl 0.13.1, tokio-rustls 0.26.6, retina 0.4.21, zstd 0.14.2,
ffmpeg-sys-next 9.0.1, oxc 0.154.0, webrtc/rtc 0.21.1
- **rusty_aac 0.5.0 → 1.1.0**: 1.x is the stabilized release with a
security-hardening pass (crafted fill-element panic on overflow-checked
builds, stale decoder state after failed blocks; output bit-identical
otherwise). Usage in this repo is test-only, no API changes needed
- **html-escape 0.2.15 → 0.3.0**: fixes multi-codepoint HTML entity
decoding and speeds up common named entities; `decode_html_entities` is
used by provider title extraction
Deliberately kept (documented/intentional pins): bincode 2.0.1 (3.0.0
placeholder), dashmap 7.0.0-rc2, opaque-ke 4.1.0-pre.2, webauthn-rs
0.6.1-dev, serde_yaml, testcontainers 0.27 (testcontainers-modules 0.15
requires ^0.27).
## Toolchain and CI
- nightly-2026-09-27 → **nightly-2026-10-13** (rust-toolchain.toml + all
workflows)
- removed the `cargo-features = ["trim-paths"]` gate (stabilized in
1.101)
- actions: checkout v7, cache v6, setup-node v7, dependency-review v5,
setup-helm v5, create-pull-request v8
## Code changes required by new clippy lints (2026-10-13)
- `try_from_instead_of_from_str`: `RoomResourceKind` now implements
`FromStr` (call site uses `.parse()`)
- `items_after_test_module`: moved 7 `#[cfg(test)]` modules to end of
file
## Dependency cleanup (new cargo `unused_dependencies` lint)
- removed 13 unused crate-level deps, including `tonic-web` which is now
unused workspace-wide
- moved test-only `tempfile` (synctv-proxy) and `anyhow`
(synctv-media-providers) to dev-dependencies
- kept `synctv-cluster` in synctv-livestream: referenced only by TLS
feature forwarding (`synctv-cluster/tls-*`), which the lint does not
account for — a known false positive
## Validation
- `make check`, `make check-all-targets`, `make clippy-check`, `make
fmt-check` all clean
- `cargo nextest run --workspace --run-ignored all`: **6969/6969
passed** (incl. docker-backed e2e)
{id="RUSTSEC-2023-0071",reason="rsa is only reached transitively and the advisory has no upstream fixed version yet"},
{id="RUSTSEC-2024-0436",reason="paste remains required by direct macros and transitive cel usage with no maintained drop-in replacement available" },
{id="RUSTSEC-2024-0449",reason="unsafe-libyaml is only reached through the intentionally pinned serde_yaml and has no maintained drop-in replacement" },
{id="RUSTSEC-2025-0134",reason="rustls-pemfile is still required for PEM parsing and the advisory has no replacement release to upgrade to"},
{id="RUSTSEC-2025-0141",reason="bincode 2 is still required by the on-disk cache format and the advisory is maintenance-only with no fixed successor release"},