fix(affine-pkg): bump reqwest 0.11 -> 0.12 (rustls-webpki 0.101.7 -> 0.103.15)

[hyperpolymath]

Refs hyperpolymath/.git-private-farm#96 (owner ruling D138: accept major dep bumps, fix breakage).

Change

• tools/affine-pkg/Cargo.toml: reqwest 0.11 -> 0.12 (rustls-tls, json, no default features).
• Lockfile now resolves reqwest 0.12.28 / rustls 0.23.45 / rustls-webpki 0.103.15 (only copy; 0.101.7 and rustls 0.21 gone — cargo tree -i rustls-webpki).
• Also declares bytes = "1" and glob = "0.3". Both are already used in src/registry.rs / src/workspace.rs but were never in the manifest, so affine-pkg did not compile on main (3x E0433). Without them the bump could not be verified.

No Rust source change was needed for the reqwest API.

Verification (local, cargo 1.97.1)

• main @ c123a3d: cargo build --locked -> FAIL (E0433 bytes x2, glob x1).
• this branch: cargo build -> OK; cargo test -> OK, 0 tests (the crate has none).

Alerts addressed (open on main)

• ci: Bump softprops/action-gh-release from 2.5.0 to 2.6.1 #3 GHSA-82j2-j2ch-gfr8 (high, patched 0.103.13)
• ci: Bump dtolnay/rust-toolchain from f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 to efa25f7f19611383d5b0ccf2d1c8914531636bf9 #2 GHSA-xgp8-3hg3-c2mh (low, patched 0.103.12)
• ci: Bump actions/setup-node from 4.0.2 to 6.3.0 #1 GHSA-965h-392x-2mh5 (low, patched 0.103.12)

All three are on tools/affine-pkg/Cargo.lock; they are the repo's only open Dependabot alerts.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 3b7ba16a-9163-4011-98e0-9f21855401b3

📥 Commits

Reviewing files that changed from the base of the PR and between c123a3d and 2d6181d.

⛔ Files ignored due to path filters (1)

• tools/affine-pkg/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• tools/affine-pkg/Cargo.toml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (9)

• GitHub Check: spark-theatre-gate / SPARK Theatre Gate
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: coverage-visibility
• GitHub Check: build
• GitHub Check: migration-assistant
• GitHub Check: vscode-smoke
• GitHub Check: bench-visibility
• GitHub Check: lint
• GitHub Check: semgrep-cloud-platform/scan

🔇 Additional comments (1)

tools/affine-pkg/Cargo.toml (1)

22-22: LGTM!

Also applies to: 24-24, 42-42

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the package manager’s underlying components. No user-facing features or behavior changes are included in this release.

Walkthrough

The package manager manifest upgrades reqwest to 0.12 and adds bytes 1 and glob 0.3.

Changes

Package manager dependencies

Layer / File(s)	Summary
Update package manager dependencies tools/affine-pkg/Cargo.toml	The manifest upgrades reqwest from 0.11 to 0.12 and adds bytes 1 and glob 0.3.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Suggested reviewers: metadatastician

Merge Risk: ⚪ Minimal · up to 2d618

The dependency changes support existing package-manager code, and no actionable merge risk is established.

Architecture Summary

Architecture risk: 🔵 Low · up to 2d618

The change affects 1 system.

Changed systems: tools

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — tools (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in tools/affine-pkg/Cargo.toml: The HTTP client dependency is upgraded from reqwest 0.11 to 0.12, and bytes 1 is added for registry download buffers.
• observed — Modified behavior in tools/affine-pkg/Cargo.toml: Adds the glob 0.3 dependency.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the reqwest version update and the related rustls-webpki change.
Description check	✅ Passed	The description explains the dependency updates, missing manifest dependencies, reported build and test results, and security alerts addressed.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the crates,
New bytes hop into place,
Glob joins the package burrow,
Reqwest takes a newer pace,
The manifest rests in order.}

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

Add Carrot credits or activate Agent usage billing to use Autopilot