From 0d23b3e3882c04241f49a32240c6c6a3c7d9b8f6 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Thu, 16 Jul 2026 18:09:30 +0000
Subject: [PATCH 1/2] chore(deps): update rust-minor-patch

---
 Cargo.toml                 | 42 +++++++++++++++++++-------------------
 crates/zeph-llm/Cargo.toml |  2 +-
 2 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index fc6d5649f..f639a894e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -16,12 +16,12 @@ categories = ["command-line-utilities", "science"]
 publish = true
 
 [workspace.dependencies]
-age = { version = "0.11.3", default-features = false }
-agent-client-protocol = "1.0.1"
-agent-client-protocol-schema = "=1.1.0"
+age = { version = "0.12.0", default-features = false }
+agent-client-protocol = "1.2.0"
+agent-client-protocol-schema = "=1.4.0"
 anyhow = "1.0.103"
 arboard = "3.6.1"
-arc-swap = "1.9.1"
+arc-swap = "1.9.2"
 async-stream = "0.3.6"
 async-trait = "0.1.89"
 audioadapter-buffers = "3.0"
@@ -29,12 +29,12 @@ axum = "0.8.9"
 base64 = "0.22.1"
 bech32 = "0.12.0"
 blake3 = "1.8.5"
-bytemuck = "1.25"
-bytes = "1.12.0"
+bytemuck = "1.25.1"
+bytes = "1.12.1"
 candle-core = { version = "0.11.0", default-features = false }
 candle-nn = { version = "0.11.0", default-features = false }
 candle-transformers = { version = "0.11.0", default-features = false }
-chacha20poly1305 = "0.10.1"
+chacha20poly1305 = "0.11.0"
 chrono = { version = "0.4.45", default-features = false }
 clap = "4.6.1"
 cpu-time = "1.0"
@@ -55,17 +55,17 @@ hex = "0.4.3"
 hf-hub = { version = "0.5", default-features = false }
 hmac = "0.13"
 http = "1.4.2"
-http-body-util = "0.1.3"
-ignore = "0.4.26"
+http-body-util = "0.1.4"
+ignore = "0.4.28"
 image = { version = "0.25", default-features = false }
 include_dir = "0.7.4"
 indexmap = "2.14.0"
 indoc = "2.0.7"
 insta = "1.48.0"
-k256 = { version = "0.13.4", default-features = false }
+k256 = { version = "0.14.0", default-features = false }
 landlock = "0.4.5"
-libsqlite3-sys = "0.37.0"
-lru = "0.18.0"
+libsqlite3-sys = "0.38.1"
+lru = "0.18.1"
 metrics = "0.24.6"
 metrics-util = "0.20.4"
 nix = { version = "0.31.3", default-features = false }
@@ -73,7 +73,7 @@ notify = "8.2.0"
 notify-debouncer-mini = "0.7"
 nucleo-matcher = "0.3.1"
 ollama-rs = { version = "0.3.5", default-features = false }
-open = "5.3.5"
+open = "5.4.0"
 opentelemetry = "0.32.0"
 opentelemetry-otlp = { version = "0.32.0", default-features = false }
 opentelemetry_sdk = { version = "0.32.1", default-features = false }
@@ -87,17 +87,17 @@ prometheus-client = "0.25.0"
 proptest = "1.11"
 pulldown-cmark = "0.13.4"
 qdrant-client = { version = "1.18", default-features = false }
-rand = "0.10.1"
+rand = "0.10.2"
 rand_distr = "0.6"
 ratatui = "0.30.2"
-regex = "1.12.4"
+regex = "1.13.0"
 reqwest = { version = "0.13.4", default-features = false }
 ripemd = "0.2"
-rmcp = "2.0.0"
+rmcp = "2.2.0"
 rubato = "3.0.0"
 rustix = { version = "1.1.4", default-features = false }
 schemars = "1.2.1"
-scrape-core = "0.2.8"
+scrape-core = "0.2.9"
 seccompiler = "0.5.0"
 semver = "1.0.28"
 serde = "1.0.228"
@@ -111,7 +111,7 @@ similar = "3.1.1"
 sqlx = { version = "0.9.0", default-features = false }
 subtle = "2.6"
 symphonia = { version = "0.6.0", default-features = false }
-sysinfo = { version = "0.39.5", default-features = false }
+sysinfo = { version = "0.39.6", default-features = false }
 teloxide = { version = "0.17", default-features = false }
 tempfile = "3.27"
 testcontainers = "0.27.3"
@@ -135,10 +135,10 @@ tracing-chrome = "0.7.2"
 tracing-opentelemetry = "0.33.0"
 tracing-subscriber = { version = "0.3.23", default-features = false }
 tracing-test = "0.2.6"
-tree-sitter = "0.26.9"
+tree-sitter = "0.26.11"
 tree-sitter-bash = "0.25.1"
 tree-sitter-go = "0.25"
-tree-sitter-highlight = "0.26.9"
+tree-sitter-highlight = "0.26.11"
 tree-sitter-javascript = "0.25"
 tree-sitter-json = "0.24.8"
 tree-sitter-md = "0.5.3"
@@ -151,7 +151,7 @@ tree-sitter-sequel = "0.3.11"
 unicode-normalization = "0.1.25"
 unicode-width = "0.2.2"
 url = "2.5.8"
-uuid = "1.23.4"
+uuid = "1.23.5"
 walkdir = "2.5"
 wiremock = "0.6.5"
 zeph-a2a = { path = "crates/zeph-a2a", version = "0.22.1" }
diff --git a/crates/zeph-llm/Cargo.toml b/crates/zeph-llm/Cargo.toml
index f6ba3629c..59932d71b 100644
--- a/crates/zeph-llm/Cargo.toml
+++ b/crates/zeph-llm/Cargo.toml
@@ -42,7 +42,7 @@ parking_lot.workspace = true
 rand.workspace = true
 rand_distr.workspace = true
 reqwest = { workspace = true, features = ["json", "multipart", "rustls", "stream"] }
-reqwest012 = { package = "reqwest", version = "0.12", default-features = false, features = ["rustls-tls"] }
+reqwest012 = { package = "reqwest", version = "0.13.4", default-features = false, features = ["rustls-tls"] }
 ripemd = { workspace = true, optional = true }
 rubato = { workspace = true, optional = true }
 schemars = { workspace = true }

From 48f0cc152ff83f0544d2783c0eb5c07a03b520de Mon Sep 17 00:00:00 2001
From: "Andrei G." <k05h31@gmail.com>
Date: Fri, 17 Jul 2026 00:29:31 +0200
Subject: [PATCH 2/2] fix(deps): resolve rust-minor-patch bundle build breakage

agent-client-protocol 1.1.0 stabilized and removed the
unstable_boolean_config/unstable_cancel_request feature flags that
zeph-acp still forwarded to, breaking cargo metadata resolution;
convert both to local no-op features. Schema 1.4.0 also renamed
SetProviderRequest/DisableProviderRequest/ProviderInfo's id field to
provider_id (a new ProviderId newtype) and made
SessionConfigOptionValue::Boolean unconditional; update zeph-acp
accordingly.

chacha20poly1305 0.11's aead 0.6 bump deprecated Array::from_slice,
KeyInit::generate_key, and AeadCore::generate_nonce in favor of
TryFrom and the new Generate trait; update the durable cipher and its
bench stub.

Revert an incorrect bump of zeph-llm's pinned reqwest012 alias (needed
only for ABI compatibility with ollama-rs's own reqwest ^0.12.28
requirement) from 0.13.4 back to 0.12, restoring the rustls-tls
feature name that only exists on that line.
---
 CHANGELOG.md                                  |  19 +
 Cargo.lock                                    | 536 +++++++++++-------
 crates/zeph-acp/Cargo.toml                    |  11 +-
 crates/zeph-acp/README.md                     |   3 +-
 crates/zeph-acp/src/agent/mod.rs              |   5 +-
 crates/zeph-acp/src/agent/providers.rs        |  71 ++-
 crates/zeph-core/src/durable.rs               |  16 +-
 .../zeph-durable/benches/durable_benches.rs   |   6 +-
 crates/zeph-llm/Cargo.toml                    |   2 +-
 specs/013-acp/spec.md                         |  16 +-
 10 files changed, 440 insertions(+), 245 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d553807e9..339100630 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -63,6 +63,25 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   `result: None`, so the TUI/CLI showed no reason at all for a timeout-killed task — reuses
   the existing `TaskGraphSnapshot` conversion (`metrics.rs`), no new widget or snapshot field.
 
+- **Dependencies**: fixed build breakage from the `rust-minor-patch` Renovate bundle
+  (`agent-client-protocol` 1.0.1 → 1.2.0, `agent-client-protocol-schema` =1.1.0 → =1.4.0,
+  `chacha20poly1305` 0.10.1 → 0.11.0, among other patch/minor bumps). `agent-client-protocol`
+  1.1.0 stabilized (and removed) the `unstable_boolean_config`/`unstable_cancel_request`
+  feature flags that `zeph-acp/Cargo.toml` still forwarded to, breaking `cargo metadata`
+  resolution outright; both are now local no-op features, matching the existing pattern for
+  other upstream-stabilized flags. Schema 1.4.0 also renamed `SetProviderRequest`/
+  `DisableProviderRequest`/`ProviderInfo`'s `id: String` field to `provider_id: ProviderId`
+  (a new `Arc<str>` newtype) and made `SessionConfigOptionValue::Boolean` unconditional —
+  `crates/zeph-acp/src/agent/providers.rs` and `mod.rs::do_set_session_config_option` updated
+  accordingly. `chacha20poly1305` 0.11's `aead` 0.6 bump deprecated/removed
+  `Array::from_slice`, `KeyInit::generate_key`, and `AeadCore::generate_nonce` in favor of
+  `TryFrom`/the new `Generate` trait; updated `crates/zeph-core/src/durable.rs` and
+  `crates/zeph-durable/benches/durable_benches.rs` accordingly. Also reverted an incorrect bump
+  of `zeph-llm`'s pinned `reqwest012` alias (a separate `reqwest 0.12.x` build needed only for
+  ABI compatibility with `ollama-rs`'s own `^0.12.28` requirement) from `0.13.4` back to `0.12`,
+  which Renovate had bumped past the version `ollama-rs` actually depends on, breaking the
+  `rustls-tls` feature name in the process.
+
 ### Testing
 
 - **zeph-orchestration** / **zeph-subagent**: closed three coverage gaps in the idle-timeout
diff --git a/Cargo.lock b/Cargo.lock
index f66b801ed..e5373d8e5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -36,6 +36,16 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "aead"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1973cfbc1a2daf9cf550e74e1f088c28e7f7d8c1e1418fb6c9dc5184b7e84c99"
+dependencies = [
+ "crypto-common 0.2.2",
+ "inout 0.2.2",
+]
+
 [[package]]
 name = "aes"
 version = "0.8.4"
@@ -43,31 +53,51 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
 dependencies = [
  "cfg-if",
- "cipher",
+ "cipher 0.4.4",
  "cpufeatures 0.2.17",
 ]
 
+[[package]]
+name = "aes-gcm"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
+dependencies = [
+ "aead 0.5.2",
+ "aes",
+ "cipher 0.4.4",
+ "ctr",
+ "ghash",
+ "subtle",
+]
+
 [[package]]
 name = "age"
-version = "0.11.3"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a07d86e4272c093c88caf7864a2d09af52a5159180848ca4832a3cdbd7d014d5"
+checksum = "fd290633c2482479f70f6d1d96ae0e9f52c6a26cd5859edd47ee1fe33fc89f26"
 dependencies = [
  "age-core",
- "base64 0.21.7",
- "bech32 0.9.1",
- "chacha20poly1305",
+ "base64 0.22.1",
+ "bech32 0.11.1",
+ "chacha20poly1305 0.10.1",
+ "cipher 0.4.4",
  "cookie-factory",
+ "hkdf 0.12.4",
  "hmac 0.12.1",
+ "hpke",
  "i18n-embed",
  "i18n-embed-fl",
  "lazy_static",
- "nom 7.1.3",
+ "ml-kem",
+ "nom 8.0.0",
+ "p256 0.13.2",
  "pin-project",
  "rand 0.8.6",
  "rust-embed",
  "scrypt",
  "sha2 0.10.9",
+ "sha3",
  "subtle",
  "x25519-dalek",
  "zeroize",
@@ -75,16 +105,18 @@ dependencies = [
 
 [[package]]
 name = "age-core"
-version = "0.11.0"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2bf6a89c984ca9d850913ece2da39e1d200563b0a94b002b253beee4c5acf99"
+checksum = "01d4375964d1501e5f1b32aef2ead573913893ff238448d4e9fdf1522d828656"
 dependencies = [
- "base64 0.21.7",
- "chacha20poly1305",
+ "base64 0.22.1",
+ "bech32 0.11.1",
+ "chacha20poly1305 0.10.1",
  "cookie-factory",
  "hkdf 0.12.4",
+ "hpke",
  "io_tee",
- "nom 7.1.3",
+ "nom 8.0.0",
  "rand 0.8.6",
  "secrecy",
  "sha2 0.10.9",
@@ -92,9 +124,9 @@ dependencies = [
 
 [[package]]
 name = "agent-client-protocol"
-version = "1.0.1"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16302d16c7531355db16593d99c38c8297db0c4653aa7dd80c3556bb17f4cd8c"
+checksum = "882b815ffa67b023e1b40e7ea3bab3f05869654e8565d6811870c5545285e1d3"
 dependencies = [
  "agent-client-protocol-derive",
  "agent-client-protocol-schema",
@@ -102,7 +134,7 @@ dependencies = [
  "blocking",
  "futures",
  "futures-concurrency",
- "rustc-hash 2.1.2",
+ "rustc-hash",
  "schemars 1.2.1",
  "serde",
  "serde_json",
@@ -114,9 +146,9 @@ dependencies = [
 
 [[package]]
 name = "agent-client-protocol-derive"
-version = "1.0.1"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88b37d552feb6981a0109febda6b71fc723678cd065974c2d76279c19c407095"
+checksum = "dd5ca63f112bd2459bcaf9eda0683b9ba95fc3b5e5fdd9036ca941c6a09345b1"
 dependencies = [
  "quote",
  "syn 2.0.118",
@@ -124,9 +156,9 @@ dependencies = [
 
 [[package]]
 name = "agent-client-protocol-schema"
-version = "1.1.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac542aba230234b1591ace7286a47c0514fe3efc3037d43296bde31ba7ee5728"
+checksum = "06679e1542356341f4550ccfb16338b64f37f6af70de2105446ef6fbb078234c"
 dependencies = [
  "anyhow",
  "derive_more 2.1.1",
@@ -304,7 +336,7 @@ dependencies = [
  "objc2-foundation",
  "parking_lot",
  "percent-encoding",
- "windows-sys 0.59.0",
+ "windows-sys 0.60.2",
  "x11rb",
 ]
 
@@ -348,7 +380,7 @@ dependencies = [
  "futures-core",
  "libc",
  "portable-atomic",
- "rustc-hash 2.1.2",
+ "rustc-hash",
  "rustix 0.38.44",
  "tokio",
  "tokio-stream",
@@ -708,12 +740,6 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
 
-[[package]]
-name = "base64"
-version = "0.21.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
-
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -737,9 +763,9 @@ dependencies = [
 
 [[package]]
 name = "bech32"
-version = "0.9.1"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d86b93f97252c47b41663388e6d155714a9d0c398b99f1005cbc5f978b29f445"
+checksum = "32637268377fc7b10a8c6d51de3e7fba1ce5dd371a96e342b34e6078db558e7f"
 
 [[package]]
 name = "bech32"
@@ -827,7 +853,7 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
 dependencies = [
- "hybrid-array",
+ "hybrid-array 0.4.13",
 ]
 
 [[package]]
@@ -1001,9 +1027,9 @@ checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"
 
 [[package]]
 name = "bytes"
-version = "1.12.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ae3f5d315924270530207e2a68396c3cc547f6dca3fbdca317cfb1a51edb593"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "candle-core"
@@ -1131,7 +1157,7 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"
 dependencies = [
- "cipher",
+ "cipher 0.4.4",
 ]
 
 [[package]]
@@ -1171,7 +1197,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
 dependencies = [
  "cfg-if",
- "cipher",
+ "cipher 0.4.4",
  "cpufeatures 0.2.17",
 ]
 
@@ -1182,6 +1208,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
 dependencies = [
  "cfg-if",
+ "cipher 0.5.2",
  "cpufeatures 0.3.0",
  "rand_core 0.10.1",
 ]
@@ -1192,13 +1219,25 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
 dependencies = [
- "aead",
+ "aead 0.5.2",
  "chacha20 0.9.1",
- "cipher",
- "poly1305",
+ "cipher 0.4.4",
+ "poly1305 0.8.0",
  "zeroize",
 ]
 
+[[package]]
+name = "chacha20poly1305"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b89e1c441e926b9c82a8d023f6e1b7ae0adcfaa7d621814e4d60789bac751cb"
+dependencies = [
+ "aead 0.6.1",
+ "chacha20 0.10.1",
+ "cipher 0.5.2",
+ "poly1305 0.9.1",
+]
+
 [[package]]
 name = "chrono"
 version = "0.4.45"
@@ -1247,10 +1286,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
  "crypto-common 0.1.7",
- "inout",
+ "inout 0.1.4",
  "zeroize",
 ]
 
+[[package]]
+name = "cipher"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
+dependencies = [
+ "block-buffer 0.12.1",
+ "crypto-common 0.2.2",
+ "inout 0.2.2",
+]
+
 [[package]]
 name = "clap"
 version = "4.6.1"
@@ -1333,7 +1383,7 @@ version = "3.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1716,7 +1766,7 @@ dependencies = [
  "cpubits",
  "ctutils",
  "getrandom 0.4.3",
- "hybrid-array",
+ "hybrid-array 0.4.13",
  "num-traits",
  "rand_core 0.10.1",
  "subtle",
@@ -1741,7 +1791,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
  "getrandom 0.4.3",
- "hybrid-array",
+ "hybrid-array 0.4.13",
  "rand_core 0.10.1",
 ]
 
@@ -1778,6 +1828,15 @@ dependencies = [
  "syn 2.0.118",
 ]
 
+[[package]]
+name = "ctr"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+dependencies = [
+ "cipher 0.4.4",
+]
+
 [[package]]
 name = "ctutils"
 version = "0.4.2"
@@ -2115,7 +2174,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer 0.10.4",
- "const-oid 0.9.6",
  "crypto-common 0.1.7",
  "subtle",
 ]
@@ -2150,7 +2208,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2259,21 +2317,7 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1a8bfa975b1aec2145850fcaa1c6fe269a16578c44705a532ae3edc92b8881c7"
 dependencies = [
- "cipher",
-]
-
-[[package]]
-name = "ecdsa"
-version = "0.16.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
-dependencies = [
- "der 0.7.10",
- "digest 0.10.7",
- "elliptic-curve 0.13.8",
- "rfc6979 0.4.0",
- "signature 2.2.0",
- "spki 0.7.3",
+ "cipher 0.4.4",
 ]
 
 [[package]]
@@ -2285,9 +2329,9 @@ dependencies = [
  "der 0.8.1",
  "digest 0.11.3",
  "elliptic-curve 0.14.1",
- "rfc6979 0.6.0",
- "signature 3.0.0",
- "spki 0.8.0",
+ "rfc6979",
+ "signature",
+ "spki",
  "zeroize",
 ]
 
@@ -2312,7 +2356,7 @@ dependencies = [
  "ff 0.13.1",
  "generic-array",
  "group 0.13.0",
- "pkcs8 0.10.2",
+ "hkdf 0.12.4",
  "rand_core 0.6.4",
  "sec1 0.7.3",
  "subtle",
@@ -2331,9 +2375,9 @@ dependencies = [
  "digest 0.11.3",
  "ff 0.14.0",
  "group 0.14.0",
- "hybrid-array",
+ "hybrid-array 0.4.13",
  "pem-rfc7468",
- "pkcs8 0.11.0",
+ "pkcs8",
  "rand_core 0.10.1",
  "sec1 0.8.1",
  "subtle",
@@ -2442,7 +2486,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2601,7 +2645,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee93edf3c501f0035bbeffeccfed0b79e14c311f12195ec0e661e114a0f60da4"
 dependencies = [
  "portable-atomic",
- "rand 0.10.1",
+ "rand 0.10.2",
  "web-time",
 ]
 
@@ -2721,9 +2765,9 @@ dependencies = [
 
 [[package]]
 name = "fluent"
-version = "0.16.1"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb74634707bebd0ce645a981148e8fb8c7bccd4c33c652aeffd28bf2f96d555a"
+checksum = "8137a6d5a2c50d6b0ebfcb9aaa91a28154e0a70605f112d30cb0cd4a78670477"
 dependencies = [
  "fluent-bundle",
  "unic-langid",
@@ -2731,16 +2775,16 @@ dependencies = [
 
 [[package]]
 name = "fluent-bundle"
-version = "0.15.3"
+version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fe0a21ee80050c678013f82edf4b705fe2f26f1f9877593d13198612503f493"
+checksum = "01203cb8918f5711e73891b347816d932046f95f54207710bda99beaeb423bf4"
 dependencies = [
  "fluent-langneg",
  "fluent-syntax",
  "intl-memoizer",
  "intl_pluralrules",
- "rustc-hash 1.1.0",
- "self_cell 0.10.3",
+ "rustc-hash",
+ "self_cell",
  "smallvec",
  "unic-langid",
 ]
@@ -2756,11 +2800,12 @@ dependencies = [
 
 [[package]]
 name = "fluent-syntax"
-version = "0.11.1"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a530c4694a6a8d528794ee9bbd8ba0122e779629ac908d15ad5a7ae7763a33d"
+checksum = "54f0d287c53ffd184d04d8677f590f4ac5379785529e5e08b1c8083acdd5c198"
 dependencies = [
- "thiserror 1.0.69",
+ "memchr",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
@@ -3287,6 +3332,16 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "ghash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1"
+dependencies = [
+ "opaque-debug",
+ "polyval",
+]
+
 [[package]]
 name = "gif"
 version = "0.14.2"
@@ -3518,6 +3573,26 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "hpke"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4917627a14198c3603282c5158b815ad5534795451d3c074b53cf3cee0960b11"
+dependencies = [
+ "aead 0.5.2",
+ "aes-gcm",
+ "chacha20poly1305 0.10.1",
+ "digest 0.10.7",
+ "generic-array",
+ "hkdf 0.12.4",
+ "hmac 0.12.1",
+ "p256 0.13.2",
+ "rand_core 0.6.4",
+ "sha2 0.10.9",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "html5ever"
 version = "0.39.0"
@@ -3550,9 +3625,9 @@ dependencies = [
 
 [[package]]
 name = "http-body-util"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
 dependencies = [
  "bytes",
  "futures-core",
@@ -3573,6 +3648,15 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
+[[package]]
+name = "hybrid-array"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2d35805454dc9f8662a98d6d61886ffe26bd465f5960e0e55345c70d5c0d2a9"
+dependencies = [
+ "typenum",
+]
+
 [[package]]
 name = "hybrid-array"
 version = "0.4.13"
@@ -3667,7 +3751,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.5.10",
+ "socket2 0.6.4",
  "system-configuration",
  "tokio",
  "tower-service",
@@ -3706,9 +3790,9 @@ dependencies = [
 
 [[package]]
 name = "i18n-embed"
-version = "0.15.4"
+version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "669ffc2c93f97e6ddf06ddbe999fcd6782e3342978bb85f7d3c087c7978404c4"
+checksum = "a217bbb075dcaefb292efa78897fc0678245ca67f265d12c351e42268fcb0305"
 dependencies = [
  "arc-swap",
  "fluent",
@@ -3726,9 +3810,9 @@ dependencies = [
 
 [[package]]
 name = "i18n-embed-fl"
-version = "0.9.4"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04b2969d0b3fc6143776c535184c19722032b43e6a642d710fa3f88faec53c2d"
+checksum = "e598ed73b67db92f61e04672e599eef2991a262a40e1666735b8a86d2e7e9f30"
 dependencies = [
  "find-crate",
  "fluent",
@@ -3891,9 +3975,9 @@ dependencies = [
 
 [[package]]
 name = "ignore"
-version = "0.4.26"
+version = "0.4.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b915661dd01db3f05050265b2477bcc6527b3792388e2749b41623cc592be67d"
+checksum = "d4ffa3a0547a138e59ddd6fa3b7c672ed47e6ad6a3cd177984ff1116aa5ba742"
 dependencies = [
  "crossbeam-deque",
  "globset",
@@ -4029,6 +4113,15 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "inout"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
+dependencies = [
+ "hybrid-array 0.4.13",
+]
+
 [[package]]
 name = "insta"
 version = "1.48.0"
@@ -4224,15 +4317,16 @@ dependencies = [
 
 [[package]]
 name = "k256"
-version = "0.13.4"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6e3919bbaa2945715f0bb6d3934a173d1e9a59ac23767fbaaef277265a7411b"
+checksum = "93f50113171a713f4a4231ef82eb26703607139b35dcb56241f0ceab2ae1f7d8"
 dependencies = [
- "cfg-if",
- "ecdsa 0.16.9",
- "elliptic-curve 0.13.8",
- "once_cell",
- "sha2 0.10.9",
+ "cpubits",
+ "ecdsa",
+ "elliptic-curve 0.14.1",
+ "primeorder 0.14.0",
+ "sha2 0.11.0",
+ "wnaf",
 ]
 
 [[package]]
@@ -4246,6 +4340,25 @@ dependencies = [
  "thiserror 2.0.18",
 ]
 
+[[package]]
+name = "keccak"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
+dependencies = [
+ "cpufeatures 0.2.17",
+]
+
+[[package]]
+name = "kem"
+version = "0.3.0-pre.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b8645470337db67b01a7f966decf7d0bafedbae74147d33e641c67a91df239f"
+dependencies = [
+ "rand_core 0.6.4",
+ "zeroize",
+]
+
 [[package]]
 name = "kqueue"
 version = "1.2.0"
@@ -4407,7 +4520,7 @@ dependencies = [
  "log",
  "md-5 0.10.6",
  "nom 8.0.0",
- "rand 0.10.1",
+ "rand 0.10.2",
  "rangemap",
  "sha2 0.10.9",
  "stringprep",
@@ -4418,9 +4531,9 @@ dependencies = [
 
 [[package]]
 name = "lru"
-version = "0.18.0"
+version = "0.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a860605968fce16869fd239cf4237a82f3ac470723415db603b0e8b6c8d4fb9"
+checksum = "0b6180140927ee907000b0aa540091f6ea512ead4447c92b8fc35bc72788a5a6"
 dependencies = [
  "hashbrown 0.17.1",
 ]
@@ -4648,6 +4761,18 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "ml-kem"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8de49b3df74c35498c0232031bb7e85f9389f913e2796169c8ab47a53993a18f"
+dependencies = [
+ "hybrid-array 0.2.3",
+ "kem",
+ "rand_core 0.6.4",
+ "sha3",
+]
+
 [[package]]
 name = "monostate"
 version = "0.1.18"
@@ -4812,7 +4937,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4942,7 +5067,7 @@ version = "5.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "51e219e79014df21a225b1860a479e2dcd7cbd9130f4defd4bd0e191ea31d67d"
 dependencies = [
- "base64 0.21.7",
+ "base64 0.22.1",
  "chrono",
  "getrandom 0.2.17",
  "http",
@@ -5139,9 +5264,9 @@ checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
 [[package]]
 name = "open"
-version = "5.3.6"
+version = "5.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd8d3b65c44123a56e0133d2cd06ce4361bd3ca99d41198b2f25e3c3db9b8b4a"
+checksum = "a0b3d059e795d52b8a72fef45658620edd4d9c359b338564aa14391ffa511ed5"
 dependencies = [
  "is-wsl",
  "libc",
@@ -5239,16 +5364,26 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "p256"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
+dependencies = [
+ "elliptic-curve 0.13.8",
+ "primeorder 0.13.6",
+]
+
 [[package]]
 name = "p256"
 version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2c9239b2dbc807adbbe147e8cf72ea7450c3a0aabe62cb8e75ff4ec22e1f72a"
 dependencies = [
- "ecdsa 0.17.0",
+ "ecdsa",
  "elliptic-curve 0.14.1",
  "primefield",
- "primeorder",
+ "primeorder 0.14.0",
  "sha2 0.11.0",
 ]
 
@@ -5607,16 +5742,6 @@ dependencies = [
  "futures-io",
 ]
 
-[[package]]
-name = "pkcs8"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
-dependencies = [
- "der 0.7.10",
- "spki 0.7.3",
-]
-
 [[package]]
 name = "pkcs8"
 version = "0.11.0"
@@ -5624,7 +5749,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7"
 dependencies = [
  "der 0.8.1",
- "spki 0.8.0",
+ "spki",
 ]
 
 [[package]]
@@ -5696,7 +5821,29 @@ checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
 dependencies = [
  "cpufeatures 0.2.17",
  "opaque-debug",
- "universal-hash",
+ "universal-hash 0.5.1",
+]
+
+[[package]]
+name = "poly1305"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2d0073b297041425c7c3df6eb4792d598a15323fe63346852b092eca02904c"
+dependencies = [
+ "cpufeatures 0.3.0",
+ "universal-hash 0.6.1",
+]
+
+[[package]]
+name = "polyval"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "opaque-debug",
+ "universal-hash 0.5.1",
 ]
 
 [[package]]
@@ -5805,6 +5952,15 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "primeorder"
+version = "0.13.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
+dependencies = [
+ "elliptic-curve 0.13.8",
+]
+
 [[package]]
 name = "primeorder"
 version = "0.14.0"
@@ -6161,9 +6317,9 @@ dependencies = [
  "pin-project-lite",
  "quinn-proto",
  "quinn-udp",
- "rustc-hash 2.1.2",
+ "rustc-hash",
  "rustls",
- "socket2 0.5.10",
+ "socket2 0.6.4",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -6182,7 +6338,7 @@ dependencies = [
  "lru-slab",
  "rand 0.9.4",
  "ring",
- "rustc-hash 2.1.2",
+ "rustc-hash",
  "rustls",
  "rustls-pki-types",
  "slab",
@@ -6201,9 +6357,9 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.5.10",
+ "socket2 0.6.4",
  "tracing",
- "windows-sys 0.59.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -6261,9 +6417,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
  "chacha20 0.10.1",
  "getrandom 0.4.3",
@@ -6332,7 +6488,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4d431c2703ccf129de4d45253c03f49ebb22b97d6ad79ee3ecfc7e3f4862c1d8"
 dependencies = [
  "num-traits",
- "rand 0.10.1",
+ "rand 0.10.2",
 ]
 
 [[package]]
@@ -6575,9 +6731,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.12.4"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -6587,9 +6743,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.14"
+version = "0.4.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+checksum = "8fcfdb36bda0c880c5931cdc7a2bcdc8ba4556847b9d912bca70bc94708711ad"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -6695,16 +6851,6 @@ dependencies = [
  "web-sys",
 ]
 
-[[package]]
-name = "rfc6979"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
-dependencies = [
- "hmac 0.12.1",
- "subtle",
-]
-
 [[package]]
 name = "rfc6979"
 version = "0.6.0"
@@ -6845,12 +6991,6 @@ version = "0.1.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b50b8869d9fc858ce7266cce0194bd74df58b9d0e3f6df3a9fc8eb470d95c09d"
 
-[[package]]
-name = "rustc-hash"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
-
 [[package]]
 name = "rustc-hash"
 version = "2.1.2"
@@ -6903,7 +7043,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6971,7 +7111,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -7051,7 +7191,7 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "97a22f5af31f73a954c10289c93e8a50cc23d971e80ee446f1f6f7137a088213"
 dependencies = [
- "cipher",
+ "cipher 0.4.4",
 ]
 
 [[package]]
@@ -7118,9 +7258,9 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "scrape-core"
-version = "0.2.8"
+version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50e7d3340e8233885563cf1fcbe829f80ef58d421cedf007b2b5b278f2590823"
+checksum = "f767555401b8e0cc27e990de5e83be5c4ea83e41ce8dd47b6c2ea8fe8b90a476"
 dependencies = [
  "cssparser",
  "html5ever",
@@ -7151,7 +7291,6 @@ dependencies = [
  "base16ct 0.2.0",
  "der 0.7.10",
  "generic-array",
- "pkcs8 0.10.2",
  "subtle",
  "zeroize",
 ]
@@ -7165,7 +7304,7 @@ dependencies = [
  "base16ct 1.0.0",
  "ctutils",
  "der 0.8.1",
- "hybrid-array",
+ "hybrid-array 0.4.13",
  "subtle",
  "zeroize",
 ]
@@ -7213,9 +7352,9 @@ dependencies = [
 
 [[package]]
 name = "selectors"
-version = "0.38.0"
+version = "0.39.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8adfa1c298912827b8a28b223b3b874357397ae706e6190acd9bf28cee99114d"
+checksum = "bad7c25c97cc59c4858df8724a3789caa6ee509b628dfe6df34e8a8084c8a84e"
 dependencies = [
  "bitflags 2.13.0",
  "cssparser",
@@ -7225,20 +7364,11 @@ dependencies = [
  "phf 0.13.1",
  "phf_codegen 0.13.1",
  "precomputed-hash",
- "rustc-hash 2.1.2",
+ "rustc-hash",
  "servo_arc",
  "smallvec",
 ]
 
-[[package]]
-name = "self_cell"
-version = "0.10.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e14e4d63b804dc0c7ec4a1e52bcb63f02c7ac94476755aa579edac21e01f915d"
-dependencies = [
- "self_cell 1.2.2",
-]
-
 [[package]]
 name = "self_cell"
 version = "1.2.2"
@@ -7514,6 +7644,16 @@ dependencies = [
  "digest 0.11.3",
 ]
 
+[[package]]
+name = "sha3"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874"
+dependencies = [
+ "digest 0.10.7",
+ "keccak",
+]
+
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
@@ -7576,16 +7716,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "signature"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
-dependencies = [
- "digest 0.10.7",
- "rand_core 0.6.4",
-]
-
 [[package]]
 name = "signature"
 version = "3.0.0"
@@ -7709,16 +7839,6 @@ dependencies = [
  "lock_api",
 ]
 
-[[package]]
-name = "spki"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
-dependencies = [
- "base64ct",
- "der 0.7.10",
-]
-
 [[package]]
 name = "spki"
 version = "0.8.0"
@@ -7877,7 +7997,7 @@ dependencies = [
  "log",
  "md-5 0.11.0",
  "memchr",
- "rand 0.10.1",
+ "rand 0.10.2",
  "serde",
  "serde_json",
  "sha2 0.11.0",
@@ -8251,9 +8371,9 @@ dependencies = [
 
 [[package]]
 name = "sysinfo"
-version = "0.39.5"
+version = "0.39.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c8bd2130a9b60bee2581bf82cfe89ee836424d1f37dcfa4ce21509611684673"
+checksum = "d2071df9448915b71c4fe6d25deaf1c22f12bd234f01540b77312bb8e41361e6"
 dependencies = [
  "libc",
  "memchr",
@@ -8387,7 +8507,7 @@ dependencies = [
  "getrandom 0.4.3",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -8602,7 +8722,7 @@ dependencies = [
  "fancy-regex 0.17.0",
  "lazy_static",
  "regex",
- "rustc-hash 2.1.2",
+ "rustc-hash",
 ]
 
 [[package]]
@@ -9189,9 +9309,9 @@ dependencies = [
 
 [[package]]
 name = "tree-sitter"
-version = "0.26.10"
+version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c343ed63e3f5c64d1acdecb5d2c13d4e169cb5fde0052106ebaa6c6f27f9e55"
+checksum = "af1c71c1c4cc0920b20d6b0f6572e7682cd07a6a2faec71067a31fa394c586df"
 dependencies = [
  "cc",
  "regex",
@@ -9223,9 +9343,9 @@ dependencies = [
 
 [[package]]
 name = "tree-sitter-highlight"
-version = "0.26.10"
+version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51d5c68e5dba9c2818166330961143812b22a286e51a107a0733766b50dfc87d"
+checksum = "cd7a0c48d503cf4e0a57a2453424eaef2fce4b4269f13e3579e52f0d0c9e5cc8"
 dependencies = [
  "regex",
  "streaming-iterator",
@@ -9365,7 +9485,7 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cb30dbbd9036155e74adad6812e9898d03ec374946234fbcebd5dfc7b9187b90"
 dependencies = [
- "rustc-hash 2.1.2",
+ "rustc-hash",
 ]
 
 [[package]]
@@ -9561,6 +9681,16 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "universal-hash"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4987bdc12753382e0bec4a65c50738ffaabc998b9cdd1f952fb5f39b0048a96"
+dependencies = [
+ "crypto-common 0.2.2",
+ "ctutils",
+]
+
 [[package]]
 name = "unsafe-libyaml-norway"
 version = "0.2.15"
@@ -9645,9 +9775,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.23.4"
+version = "1.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf80a72845275afea99e7f2b434723d3bc7e38470fcd1c7ed39a599c73319a53"
+checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239"
 dependencies = [
  "atomic",
  "getrandom 0.4.3",
@@ -9987,7 +10117,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -10418,7 +10548,7 @@ checksum = "ab12e7090f27e2ffd9322651492942d50c2926094af30601e1964337db39daf1"
 dependencies = [
  "ff 0.14.0",
  "group 0.14.0",
- "hybrid-array",
+ "hybrid-array 0.4.13",
 ]
 
 [[package]]
@@ -10611,7 +10741,7 @@ dependencies = [
  "hex",
  "hmac 0.13.0",
  "http-body-util",
- "p256",
+ "p256 0.14.0",
  "reqwest 0.13.4",
  "serde",
  "serde_json",
@@ -10896,7 +11026,7 @@ dependencies = [
  "age",
  "base64 0.22.1",
  "blake3",
- "chacha20poly1305",
+ "chacha20poly1305 0.11.0",
  "chrono",
  "cpu-time",
  "criterion",
@@ -10911,7 +11041,7 @@ dependencies = [
  "ordered-float 5.3.0",
  "parking_lot",
  "proptest",
- "rand 0.10.1",
+ "rand 0.10.2",
  "regex",
  "reqwest 0.13.4",
  "rmcp",
@@ -10984,11 +11114,11 @@ version = "0.22.1"
 dependencies = [
  "blake3",
  "bytes",
- "chacha20poly1305",
+ "chacha20poly1305 0.11.0",
  "criterion",
  "futures",
  "metrics",
- "rand 0.10.1",
+ "rand 0.10.2",
  "rustix 1.1.4",
  "serde",
  "serde_json",
@@ -11011,7 +11141,7 @@ dependencies = [
  "futures",
  "ordered-float 5.3.0",
  "proptest",
- "rand 0.10.1",
+ "rand 0.10.2",
  "schemars 1.2.1",
  "serde",
  "serde_json",
@@ -11101,7 +11231,7 @@ dependencies = [
  "ollama-rs",
  "parking_lot",
  "proptest",
- "rand 0.10.1",
+ "rand 0.10.2",
  "rand_distr 0.6.0",
  "reqwest 0.12.28",
  "reqwest 0.13.4",
@@ -11142,7 +11272,7 @@ dependencies = [
  "open",
  "parking_lot",
  "qdrant-client",
- "rand 0.10.1",
+ "rand 0.10.2",
  "regex",
  "reqwest 0.13.4",
  "rmcp",
@@ -11219,7 +11349,7 @@ dependencies = [
  "dirs",
  "futures",
  "parking_lot",
- "rand 0.10.1",
+ "rand 0.10.2",
  "rand_distr 0.6.0",
  "schemars 1.2.1",
  "serde",
@@ -11274,7 +11404,7 @@ dependencies = [
  "image",
  "parking_lot",
  "proptest",
- "rand 0.10.1",
+ "rand 0.10.2",
  "regex",
  "serde",
  "serde_json",
diff --git a/crates/zeph-acp/Cargo.toml b/crates/zeph-acp/Cargo.toml
index f3e70bbee..b6f32955e 100644
--- a/crates/zeph-acp/Cargo.toml
+++ b/crates/zeph-acp/Cargo.toml
@@ -31,10 +31,13 @@ unstable-llm-providers = ["dep:agent-client-protocol-schema", "agent-client-prot
 # logout stabilized in acp 0.13.0; no upstream feature gate needed
 unstable-logout = []
 unstable-auth-methods = ["agent-client-protocol/unstable_auth_methods"]
-unstable-boolean-config = ["agent-client-protocol/unstable_boolean_config"]
-# Wires the real $/cancel_request protocol notification (agent-client-protocol crate level,
-# available since SDK 0.15.1) onto the existing internal cancel_signal. Not in `default` — see #5362.
-unstable-cancel-request = ["agent-client-protocol/unstable_cancel_request"]
+# boolean session-config values stabilized in acp-schema 1.1.0 (SessionConfigOptionValue::Boolean
+# is now unconditional); no upstream feature gate needed
+unstable-boolean-config = []
+# Wires the real $/cancel_request protocol notification onto the existing internal cancel_signal.
+# Cancellation itself was stabilized upstream in acp 1.1.0 (no feature gate needed there anymore);
+# this stays a local opt-in gate for the zeph-acp integration. Not in `default` — see #5362.
+unstable-cancel-request = []
 # message-id stabilized in acp 0.14.0; no upstream feature gate needed
 unstable-message-id = []
 # session-add-dirs stabilized in acp 0.14.0; no upstream feature gate needed
diff --git a/crates/zeph-acp/README.md b/crates/zeph-acp/README.md
index e025803d1..f1480a629 100644
--- a/crates/zeph-acp/README.md
+++ b/crates/zeph-acp/README.md
@@ -369,9 +369,8 @@ The `initialize` response includes an `auth_hint` key in its metadata map. For s
 | `unstable-llm-providers` | unstable | Exposes the `LlmProtocol` wire type for advertising available LLM providers to the IDE. |
 | `unstable-logout` | unstable | Enables the `logout` ACP method and advertises `auth.logout` capability. Zeph logout is a no-op (vault-based auth). |
 | `unstable-auth-methods` | unstable | Enables the ACP auth-methods extension. |
-| `unstable-boolean-config` | unstable | Enables boolean-valued session config options. |
 | `unstable-cancel-request` | unstable | Wires the real `$/cancel_request` protocol notification onto the internal cancel signal. |
-| `unstable-message-id` / `unstable-session-add-dirs` / `unstable-session-delete` | stable in SDK | Retained as no-op flags; the underlying methods stabilized upstream and need no gate. |
+| `unstable-message-id` / `unstable-session-add-dirs` / `unstable-session-delete` / `unstable-boolean-config` | stable in SDK | Retained as no-op flags; the underlying methods/types stabilized upstream and need no gate. |
 
 **Warning:**
 > All `unstable-*` features have wire protocol that is not yet finalized. Expect breaking changes before these features graduate to stable.
diff --git a/crates/zeph-acp/src/agent/mod.rs b/crates/zeph-acp/src/agent/mod.rs
index 27e42867a..40dde5ab8 100644
--- a/crates/zeph-acp/src/agent/mod.rs
+++ b/crates/zeph-acp/src/agent/mod.rs
@@ -2250,9 +2250,8 @@ impl ZephAcpAgentState {
         args: acp::schema::v1::SetSessionConfigOptionRequest,
     ) -> acp::Result<acp::schema::v1::SetSessionConfigOptionResponse> {
         let config_id = args.config_id.0.clone();
-        #[cfg(not(feature = "unstable-boolean-config"))]
-        let value_str: std::sync::Arc<str> = args.value.0.clone();
-        #[cfg(feature = "unstable-boolean-config")]
+        // `SessionConfigOptionValue::Boolean` was stabilized in acp-schema 1.1.0 and the enum
+        // shape is now unconditional, so this always matches (no feature gate needed).
         let value_str: std::sync::Arc<str> = match &args.value {
             acp::schema::v1::SessionConfigOptionValue::ValueId { value } => value.0.clone(),
             acp::schema::v1::SessionConfigOptionValue::Boolean { value } => {
diff --git a/crates/zeph-acp/src/agent/providers.rs b/crates/zeph-acp/src/agent/providers.rs
index d5e5b36c8..ae2713287 100644
--- a/crates/zeph-acp/src/agent/providers.rs
+++ b/crates/zeph-acp/src/agent/providers.rs
@@ -78,7 +78,7 @@ impl ZephAcpAgentState {
                 let req: schema::DisableProviderRequest =
                     serde_json::from_str(args.params.get())
                         .map_err(|e| acp::Error::invalid_request().data(e.to_string()))?;
-                let resp = self.do_disable_providers(req)?;
+                let resp = self.do_disable_providers(&req)?;
                 let json = serde_json::to_string(&resp)
                     .map_err(|e| acp::Error::internal_error().data(e.to_string()))?;
                 let raw = serde_json::value::RawValue::from_string(json)
@@ -142,26 +142,29 @@ impl ZephAcpAgentState {
     ///
     /// # Errors
     ///
-    /// Returns `invalid_params` if `req.id` is not in the registered provider list.
+    /// Returns `invalid_params` if `req.provider_id` is not in the registered provider list.
     #[tracing::instrument(skip_all, name = "acp.handler.set_providers")]
     pub(crate) fn do_set_providers(
         &self,
         req: agent_client_protocol_schema::v1::SetProviderRequest,
     ) -> acp::Result<agent_client_protocol_schema::v1::SetProviderResponse> {
-        if !self.provider_names.iter().any(|(name, _)| name == &req.id) {
-            return Err(
-                acp::Error::invalid_params().data(format!("unknown provider id: {}", req.id))
-            );
+        if !self
+            .provider_names
+            .iter()
+            .any(|(name, _)| name.as_str() == req.provider_id.0.as_ref())
+        {
+            return Err(acp::Error::invalid_params()
+                .data(format!("unknown provider id: {}", req.provider_id)));
         }
         self.global_provider_overrides.lock().insert(
-            req.id.clone(),
+            req.provider_id.to_string(),
             ProviderSetOverride {
                 api_type: req.api_type,
                 base_url: req.base_url,
                 headers: req.headers,
             },
         );
-        tracing::debug!(provider_id = %req.id, "provider override set");
+        tracing::debug!(provider_id = %req.provider_id, "provider override set");
         Ok(agent_client_protocol_schema::v1::SetProviderResponse::new())
     }
 
@@ -175,9 +178,9 @@ impl ZephAcpAgentState {
     #[tracing::instrument(skip_all, name = "acp.handler.disable_providers")]
     pub(crate) fn do_disable_providers(
         &self,
-        req: agent_client_protocol_schema::v1::DisableProviderRequest,
+        req: &agent_client_protocol_schema::v1::DisableProviderRequest,
     ) -> acp::Result<agent_client_protocol_schema::v1::DisableProviderResponse> {
-        let id = req.id;
+        let id = req.provider_id.to_string();
         tracing::debug!(provider_id = %id, "provider disabled");
         self.global_disabled_providers.lock().insert(id);
         Ok(agent_client_protocol_schema::v1::DisableProviderResponse::new())
@@ -207,7 +210,11 @@ mod tests {
             .do_list_providers(schema::ListProvidersRequest::new())
             .unwrap();
         assert_eq!(resp.providers.len(), 2);
-        let ids: Vec<&str> = resp.providers.iter().map(|p| p.id.as_str()).collect();
+        let ids: Vec<&str> = resp
+            .providers
+            .iter()
+            .map(|p| p.provider_id.0.as_ref())
+            .collect();
         assert!(ids.contains(&"openai"));
         assert!(ids.contains(&"claude"));
     }
@@ -228,7 +235,11 @@ mod tests {
         let resp = state
             .do_list_providers(schema::ListProvidersRequest::new())
             .unwrap();
-        let openai = resp.providers.iter().find(|p| p.id == "openai").unwrap();
+        let openai = resp
+            .providers
+            .iter()
+            .find(|p| p.provider_id.0.as_ref() == "openai")
+            .unwrap();
         let current = openai
             .current
             .as_ref()
@@ -238,7 +249,11 @@ mod tests {
             schema::LlmProtocol::OpenAi,
             "openai provider must report OpenAi protocol"
         );
-        let claude = resp.providers.iter().find(|p| p.id == "claude").unwrap();
+        let claude = resp
+            .providers
+            .iter()
+            .find(|p| p.provider_id.0.as_ref() == "claude")
+            .unwrap();
         let current = claude
             .current
             .as_ref()
@@ -254,17 +269,25 @@ mod tests {
     fn disable_provider_hides_current_config_in_list() {
         let state = make_state();
         state
-            .do_disable_providers(schema::DisableProviderRequest::new("openai"))
+            .do_disable_providers(&schema::DisableProviderRequest::new("openai"))
             .unwrap();
         let resp = state
             .do_list_providers(schema::ListProvidersRequest::new())
             .unwrap();
-        let openai = resp.providers.iter().find(|p| p.id == "openai").unwrap();
+        let openai = resp
+            .providers
+            .iter()
+            .find(|p| p.provider_id.0.as_ref() == "openai")
+            .unwrap();
         assert!(
             openai.current.is_none(),
             "disabled provider must have no current config"
         );
-        let claude = resp.providers.iter().find(|p| p.id == "claude").unwrap();
+        let claude = resp
+            .providers
+            .iter()
+            .find(|p| p.provider_id.0.as_ref() == "claude")
+            .unwrap();
         assert!(
             claude.current.is_some(),
             "non-disabled provider must still have current config"
@@ -275,7 +298,7 @@ mod tests {
     fn disable_unknown_provider_succeeds() {
         let state = make_state();
         state
-            .do_disable_providers(schema::DisableProviderRequest::new("nonexistent"))
+            .do_disable_providers(&schema::DisableProviderRequest::new("nonexistent"))
             .unwrap();
     }
 
@@ -315,7 +338,11 @@ mod tests {
         let resp = state
             .do_list_providers(schema::ListProvidersRequest::new())
             .unwrap();
-        let openai = resp.providers.iter().find(|p| p.id == "openai").unwrap();
+        let openai = resp
+            .providers
+            .iter()
+            .find(|p| p.provider_id.0.as_ref() == "openai")
+            .unwrap();
         let current = openai.current.as_ref().expect("override must be present");
         assert_eq!(current.base_url, "https://custom.example.com");
     }
@@ -334,12 +361,16 @@ mod tests {
             )
             .unwrap();
         state
-            .do_disable_providers(schema::DisableProviderRequest::new("openai"))
+            .do_disable_providers(&schema::DisableProviderRequest::new("openai"))
             .unwrap();
         let resp = state
             .do_list_providers(schema::ListProvidersRequest::new())
             .unwrap();
-        let openai = resp.providers.iter().find(|p| p.id == "openai").unwrap();
+        let openai = resp
+            .providers
+            .iter()
+            .find(|p| p.provider_id.0.as_ref() == "openai")
+            .unwrap();
         assert!(
             openai.current.is_none(),
             "provider disabled after set must have no current config"
diff --git a/crates/zeph-core/src/durable.rs b/crates/zeph-core/src/durable.rs
index 5e694ef85..a8a90decc 100644
--- a/crates/zeph-core/src/durable.rs
+++ b/crates/zeph-core/src/durable.rs
@@ -29,7 +29,7 @@
 
 use chacha20poly1305::{
     Key, KeyInit, XChaCha20Poly1305, XNonce,
-    aead::{Aead, AeadCore, OsRng, Payload},
+    aead::{Aead, Generate, Payload},
 };
 use zeph_durable::{CipherError, PayloadAad, PayloadCipher};
 use zeroize::Zeroize;
@@ -81,7 +81,7 @@ struct KeySlot {
 impl KeySlot {
     /// Build a slot, copying the key into the AEAD state and zeroizing the transient input.
     fn new(key_id: u8, mut key: [u8; KEY_LEN]) -> Self {
-        let cipher = XChaCha20Poly1305::new(Key::from_slice(&key));
+        let cipher = XChaCha20Poly1305::new((&key).into());
         key.zeroize();
         Self { key_id, cipher }
     }
@@ -245,14 +245,14 @@ pub fn derive_control_hmac_key_b64(b64_key: &str) -> Result<[u8; KEY_LEN], Ciphe
 #[must_use]
 pub fn generate_durable_key_b64() -> String {
     use base64::Engine as _;
-    let key = XChaCha20Poly1305::generate_key(&mut OsRng);
+    let key = Key::generate();
     base64::engine::general_purpose::STANDARD.encode(key.as_slice())
 }
 
 impl PayloadCipher for XChaCha20Poly1305Cipher {
     fn seal(&self, plaintext: &[u8], aad: &PayloadAad) -> Result<Vec<u8>, CipherError> {
         let aad_bytes = aad.canonical_bytes();
-        let nonce = XChaCha20Poly1305::generate_nonce(&mut OsRng);
+        let nonce = XNonce::generate();
         let ciphertext = self
             .current
             .cipher
@@ -283,13 +283,17 @@ impl PayloadCipher for XChaCha20Poly1305Cipher {
             .select(key_id)
             .ok_or(CipherError::UnknownKeyId { key_id })?;
 
-        let nonce = XNonce::from_slice(&sealed[KEY_ID_LEN..NONCE_END]);
+        let nonce = XNonce::try_from(&sealed[KEY_ID_LEN..NONCE_END]).map_err(|_| {
+            CipherError::Malformed {
+                context: "nonce slice is not exactly NONCE_LEN bytes",
+            }
+        })?;
         let ciphertext = &sealed[NONCE_END..];
         let aad_bytes = aad.canonical_bytes();
 
         cipher
             .decrypt(
-                nonce,
+                &nonce,
                 Payload {
                     msg: ciphertext,
                     aad: &aad_bytes,
diff --git a/crates/zeph-durable/benches/durable_benches.rs b/crates/zeph-durable/benches/durable_benches.rs
index a97c9d6b6..f8fc15c9d 100644
--- a/crates/zeph-durable/benches/durable_benches.rs
+++ b/crates/zeph-durable/benches/durable_benches.rs
@@ -74,10 +74,12 @@ impl PayloadCipher for BenchCipher {
         if key_id != 0 {
             return Err(CipherError::UnknownKeyId { key_id });
         }
-        let nonce = XNonce::from_slice(&sealed[1..25]);
+        let nonce = XNonce::try_from(&sealed[1..25]).map_err(|_| CipherError::Malformed {
+            context: "nonce slice is not exactly 24 bytes",
+        })?;
         self.inner
             .decrypt(
-                nonce,
+                &nonce,
                 chacha20poly1305::aead::Payload {
                     msg: &sealed[25..],
                     aad: &aad.canonical_bytes(),
diff --git a/crates/zeph-llm/Cargo.toml b/crates/zeph-llm/Cargo.toml
index 59932d71b..f6ba3629c 100644
--- a/crates/zeph-llm/Cargo.toml
+++ b/crates/zeph-llm/Cargo.toml
@@ -42,7 +42,7 @@ parking_lot.workspace = true
 rand.workspace = true
 rand_distr.workspace = true
 reqwest = { workspace = true, features = ["json", "multipart", "rustls", "stream"] }
-reqwest012 = { package = "reqwest", version = "0.13.4", default-features = false, features = ["rustls-tls"] }
+reqwest012 = { package = "reqwest", version = "0.12", default-features = false, features = ["rustls-tls"] }
 ripemd = { workspace = true, optional = true }
 rubato = { workspace = true, optional = true }
 schemars = { workspace = true }
diff --git a/specs/013-acp/spec.md b/specs/013-acp/spec.md
index 2ceedc06b..61e6125d9 100644
--- a/specs/013-acp/spec.md
+++ b/specs/013-acp/spec.md
@@ -8,7 +8,7 @@ tags:
   - protocol
   - acp
 created: 2026-04-08
-updated: 2026-07-01
+updated: 2026-07-17
 status: approved
 related:
   - "[[MOC-specs]]"
@@ -19,7 +19,7 @@ related:
 
 > [!info]
 > ACP transports, session management, permissions, fork/resume,
-> capability advertisement, agent-client-protocol 1.0.1 / schema =1.1.0 compatibility.
+> capability advertisement, agent-client-protocol 1.2.0 / schema =1.4.0 compatibility.
 
 ## Spec Changelog
 
@@ -33,6 +33,7 @@ related:
 | 1.5 | 2026-07-01 | developer | Adopt `model_config` option category (#5361): new `config_id="temperature"` `session/set_config_option`, presets precise/balanced/creative, `[acp.model_config]` config section, CLI + wizard integration. Wire `unstable_cancel_request` (#5362): new `unstable-cancel-request` Cargo feature (not in `default`), `$/cancel_request` bridged onto `cancel_signal: Arc<Notify>` via `Responder::cancellation()` in `session/prompt`, plus a low-level tracing-only `CancelRequestNotification` handler in the `Agent.builder()` chain. Added test coverage for the 8 previously-untested handler files (#5367). |
 | 1.6 | 2026-07-01 | developer | Review fix pass on #5361/#5362: (S-C1) `default_temperature_preset` is now primed into the effective `provider_override` at session creation (`do_new_session`/`do_load_session`/`do_fork_session`/`do_resume_session`), not just advertised in the IDE dropdown; (S-C2) the `$/cancel_request` watcher select is now `biased` with prompt completion checked first, and `drain_agent_events` drains a stale `cancel_signal` permit before its main loop, so a cancellation resolving at/after prompt completion can no longer leak into the next, unrelated prompt (also hardens the pre-existing `session/cancel` no-active-prompt race — `cancel_before_prompt_returns_cancelled` renamed to `cancel_before_prompt_is_a_no_op` to reflect the corrected semantics). Documented fork/resume reset behavior for `temperature_preset` (#5373 tracking issue filed); filed #5374 for the untested `resume_session` store-backed path. |
 | 1.7 | 2026-07-01 | developer | Fixed #5379: `zeph acp model-config show` now loads the resolved config and marks the active `[acp.model_config].default_temperature_preset` in its output, instead of only printing the static preset table. Resolved #5373: `session/fork` and `session/resume` now inherit `model`/`temperature_preset`/`thinking_enabled`/`auto_approve_level` from the source session (live in-memory state, falling back to a persisted close-time snapshot, falling back to configured defaults) instead of always resetting to defaults — new `acp_sessions` columns via migration `105_acp_session_config`; see "Fork/Resume Config Inheritance" below. |
+| 1.8 | 2026-07-17 | developer | Renovate `rust-minor-patch` bundle bumped core `1.0.1`→`1.2.0`, schema `=1.1.0`→`=1.4.0`. Core `1.1.0` stabilized `$/cancel_request` unconditionally and dropped its `unstable_cancel_request` forward — `unstable-cancel-request` is now a local-only opt-in gate (Cargo feature unchanged, but no longer maps to an upstream feature); `unstable-boolean-config` tombstoned the same way after schema `1.1.0` made `SessionConfigOptionValue::Boolean` unconditional. Schema `1.4.0` renamed `SetProviderRequest`/`DisableProviderRequest`/`ProviderInfo`'s `id: String` field to `provider_id: ProviderId` (`Arc<str>` newtype) — updated all `providers.rs` call sites and tests. No handler/transport/builder-chain logic changed otherwise. |
 
 ---
 
@@ -297,13 +298,13 @@ exposing tools over ACP.
 | `unstable-elicitation` | **active** | Now also adds `agent-client-protocol/unstable_elicitation` passthrough so core wires `elicitation/create` |
 | `unstable-llm-providers` | **active** | Still gated upstream (`unstable_llm_providers`); provider type renames apply here (see Providers API) |
 | `unstable-auth-methods` | **active** | Still gated upstream (`unstable_auth_methods`) |
-| `unstable-boolean-config` | **active** | Still gated upstream (`unstable_boolean_config`) |
+| `unstable-boolean-config` | **tombstone** `= []` | Stabilized — `SessionConfigOptionValue::Boolean` is unconditional since schema 1.1.0 (core 1.1.0 dropped its `unstable_boolean_config` forward). `do_set_session_config_option` always matches the enum; flag retained as no-op. |
 | `unstable-session-delete` | **tombstone** `= []` | Stabilized — `session/delete` handler is unconditional in core 1.0.1 (since the 0.14.0 bump). Flag retained as no-op for workspace forwarding (root `Cargo.toml` references it). |
 | `unstable-session-resume` | **tombstone** `= []` | Stabilized — `session/resume` handler is unconditional in core 1.0.1 (since the 0.14.0 bump). Flag retained as no-op. |
 | `unstable-logout` | **tombstone** `= []` | Stabilized — logout handler is unconditional in core 1.0.1 (since the 0.14.0 bump). Flag retained as no-op. |
 | `unstable-session-add-dirs` | **tombstone** `= []` | Stabilized — `additional_directories` field is plain `Vec<PathBuf>`, unconditional since schema 0.13.6 (now schema 1.1.0). Flag retained as no-op. |
 | `unstable-message-id` | **tombstone** `= []` | Removed — `PromptRequest.message_id` and `PromptResponse.user_message_id` deleted upstream. Entire inbound echo feature removed. Flag retained as no-op for workspace forwarding. |
-| `unstable-cancel-request` | **active** | Implemented (#5362). Maps to upstream `agent-client-protocol/unstable_cancel_request` (available at the ACP-crate level since SDK 0.15.1). Not in `default` — opt-in only. The `session/prompt` handler (`agent/handlers/prompt.rs`) bridges `Responder::cancellation()`, scoped to that specific JSON-RPC request, onto the session's existing `cancel_signal: Arc<Notify>` (the same signal `session/cancel` notifies in `agent/handlers/cancel.rs`) via a short-lived watcher task that races cancellation against prompt completion. A low-level `CancelRequestNotification` handler is also registered in the `Agent.builder()` chain (`agent/mod.rs`) for tracing-only observability — the SDK updates per-request cancellation markers automatically regardless of whether a handler is registered. |
+| `unstable-cancel-request` | **active (local-only gate)** | Implemented (#5362). Core `1.1.0` made `$/cancel_request` unconditional and dropped the `unstable_cancel_request` feature entirely, so this Zeph flag no longer forwards to any upstream feature — it is now purely a local opt-in for the zeph-acp bridge itself. Not in `default`. The `session/prompt` handler (`agent/handlers/prompt.rs`) bridges `Responder::cancellation()`, scoped to that specific JSON-RPC request, onto the session's existing `cancel_signal: Arc<Notify>` (the same signal `session/cancel` notifies in `agent/handlers/cancel.rs`) via a short-lived watcher task that races cancellation against prompt completion. A low-level `CancelRequestNotification` handler is also registered in the `Agent.builder()` chain (`agent/mod.rs`) for tracing-only observability — the SDK updates per-request cancellation markers automatically regardless of whether a handler is registered. |
 | `unstable-session-model` | **DELETED** | Removed entirely — `session/set_model` RPC deleted upstream. Feature name removed from Cargo.toml and root `Cargo.toml`. Model switching survives via `set_config_option`. |
 
 > **Tombstone flags** are `= []` no-ops retained solely so root `Cargo.toml` feature forwarding
@@ -455,6 +456,13 @@ Schema 0.11.7 introduced a providers management API (`unstable` in SDK):
 All renamed types have `::new()` constructors. All four remain gated behind
 `unstable_llm_providers` (Zeph flag `unstable-llm-providers` retained).
 
+**Breaking change in schema 1.4.0 bump — field rename:** `SetProviderRequest`,
+`DisableProviderRequest`, and `ProviderInfo` all renamed their `id: String` field to
+`provider_id: ProviderId` (`ProviderId` is a new `#[non_exhaustive] struct ProviderId(pub Arc<str>)`
+newtype implementing `Display`/`From<Arc<str>>`/`From<String>`/`From<&'static str>`). All
+`providers.rs` handler and test call sites updated to the new field name and to convert via
+`.0.as_ref()` / `.to_string()` where a borrowed `&str` or owned `String` is needed.
+
 **Design note — impedance mismatch**: The Providers API is NOT a direct mapping to Zeph's
 `[[llm.providers]]` TOML config. Key tensions: