chore(deps): refresh lockfile off RUSTSEC advisories

.cargo/config.toml

@@ -4,3 +4,14 @@
 # creates the `+`-form helper-binary symlinks git invokes by scheme
 # (see xtask/src/install.rs and README §Quick install).
 xtask = "run --package xtask --quiet --"
+
+[resolver]
+# Keep `cargo update` inside the workspace MSRV. Cargo's resolver
+# ignores `rust-version` by default, so a routine `cargo update` can
+# pull a dependency that no longer builds on our floor — and a patch
+# release is enough to do it: `kstring` 2.0.3 lifted its own floor from
+# 1.73 to 1.96. Such a break surfaces only under CI's toolchain, never
+# under a newer local stable. `fallback` makes cargo prefer the newest
+# version that still satisfies `rust-version`, reaching past it only
+# when no compatible option exists.
+incompatible-rust-versions = "fallback"

.github/dependabot.yml

@@ -16,6 +16,9 @@ updates:
     commit-message:
       prefix: "chore"
     ignore:
-      # MSRV is 1.94 — block updates that bump the minimum Rust version.
+      # Skip semver-major bumps; they usually need code changes. This
+      # does not catch every MSRV raise — kstring 2.0.3 lifted its floor
+      # from 1.73 to 1.96 in a patch release — so the real guard is
+      # `resolver.incompatible-rust-versions` in .cargo/config.toml.
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]

CHANGELOG.md

@@ -9,12 +9,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
+- deps: refreshed the lockfile, clearing RUSTSEC-2026-0258 (`h2`
+  0.4.13 → 0.4.19; empty DATA frames were accepted and queued without
+  limit, so a stream that is not actively drained could grow memory
+  unboundedly or panic on length overflow) and RUSTSEC-2026-0253 (`lru`
+  0.16.4 → 0.18.3; `LruCache::pop()` was not panic-safe, leaving
+  dangling pointers in the intrusive list when a key's `Drop` panicked,
+  which a later eviction would then dereference). `lru` is reachable
+  only through `aws-sdk-s3`, which pinned `lru ^0.16.3` until 1.144.0 —
+  so the fix carries `aws-sdk-s3` 1.137.0 → 1.144.0 and `aws-config`
+  1.8.18 → 1.11.0 with it. The same refresh moves `chacha20` off the
+  yanked 0.10.0.
 - deps: bumped `event-listener` (transitive, via `azure_core` →
   `async-lock`) from 5.4.1 to 5.4.2, clearing RUSTSEC-2026-0221
   (`StackSlot<'_, T>` unconditionally implements `Send`/`Sync`, letting
   a `!Send` tag set via `Event::with_tag` cross a thread boundary and
   race in safe code).
 
+### Changed
+
+- msrv: raised the minimum supported Rust version from 1.94 to 1.96.
+  `aws-sdk-s3` 1.144.0 and `aws-config` 1.11.0 require 1.94.1, and
+  `kstring` 2.0.3 (transitive, via `gix-attributes`) requires 1.96;
+  taking 1.96 keeps the lockfile on the newest release of each rather
+  than pinning dependencies back to hold an older floor.
+- build: `.cargo/config.toml` now sets `resolver.incompatible-rust-versions
+  = "fallback"`, so `cargo update` prefers dependency versions that still
+  satisfy the workspace `rust-version` instead of silently selecting one
+  that no longer builds on the declared floor.
+
 ### Documentation
 
 - release: corrected `docs/development/cutting-a-release.md`, which

CONTRIBUTING.md

@@ -24,7 +24,7 @@ cargo test --workspace
 ```
 
 MSRV is declared in the workspace `Cargo.toml` (`rust-version`).
-The current floor is **Rust 1.94**.
+The current floor is **Rust 1.96**.
 
 The repository ships a `Makefile` that mirrors CI: