Upgrade warp to 0.4.2

Signed-off-by: Erick Bourgeois <erick@jeb.ca>

Author: ebourgeois

.claude/CHANGELOG.md

@@ -9,6 +9,55 @@ The format is based on the regulated environment requirements:
 
 ---
 
+## [2026-05-02 12:00] - warp 0.4.2 migration (PR #52 follow-up)
+
+**Author:** Erick Bourgeois
+
+### Changed
+- `Cargo.toml`: pin `warp = { version = "0.4", default-features = false, features = ["server"] }`.
+  warp 0.4 made every previously-default feature opt-in; we only need
+  `server` (used by `src/main.rs::run_metrics_server` and
+  `src/health.rs::start_health_server`). `default-features = false`
+  also drops `multipart`, `websocket`, and `test`, which we don't
+  use, shrinking the supply-chain surface visible to cargo-deny /
+  Grype / auto-VEX.
+- `src/health.rs`: every closure body that returned `&'static str`
+  now returns `String` (warp 0.4's `Reply` impl on `&str` is gated
+  to `&'static str` only and the if/else inference would otherwise
+  pick a non-'static lifetime). Final filter chain calls `.boxed()`
+  to type-erase into `BoxedFilter` — without it the filter type
+  carries a higher-ranked `AsRef<str>` bound from the new generic
+  `path::path<P: AsRef<str>>` signature, which propagates through
+  `tokio::spawn` and fails `Send + 'static`.
+- `src/main.rs`: `warp::serve(metrics.boxed())` for the same
+  HRTB / Send reason as health.rs.
+- `Cargo.lock`: regenerated (warp 0.3.7 → 0.4.2; drops the legacy
+  hyper 0.14 / http 0.2 / h2 0.3 / base64 0.21 / encoding_rs /
+  displaydoc duplicate-stack now that warp pulls hyper 1).
+
+### Why
+PR #52 (Dependabot) bumped warp 0.3 → 0.4; the upstream release is
+breaking (server/test feature-gated, hyper 1 underneath, narrower
+Reply bounds, generic `path()`). The bump is the unfinished tail of
+the auto-VEX Phase 3 work in `5spot-automated-vex-generation.md` —
+warp 0.3 sits on hyper 0.14 which is end-of-life upstream and visible
+to the supply-chain scanners tracked in
+`5spot-code-scanning-remediation.md`.
+
+### Impact
+- [ ] Breaking change (no API surface change; internal-only)
+- [x] Requires cluster rollout (new binary)
+- [ ] Config change only
+- [ ] Documentation only
+
+### Verification
+- `cargo build` clean.
+- `cargo test`: 397 passed, 0 failed.
+- `cargo fmt --check`: clean.
+- `cargo clippy --all-targets -- -D warnings`: clean.
+
+---
+
 ## [2026-04-26 00:30] - Phase 4 of security audit: reclaim-agent host-identity verification
 
 **Author:** Erick Bourgeois

Cargo.lock

@@ -49,7 +49,11 @@ http-body-util = "0.1"
 tower = "0.5"
 regex = "1"
 lazy_static = "1.5"
-warp = "0.4"
+# warp 0.4 made every previously-default feature opt-in. We use
+# `warp::serve` for the metrics + health/readiness HTTP servers
+# (src/main.rs and src/health.rs), so the `server` feature must be
+# enabled explicitly.
+warp = { version = "0.4", default-features = false, features = ["server"] }
 toml = "1.1"
 
 [[bin]]

Cargo.toml

@@ -95,24 +95,37 @@ pub async fn start_health_server(port: u16, health_state: HealthState) {
     let health_state_status = health_state;
 
     // /healthz - Kubernetes liveness probe
-    // Returns 200 if the process is alive
+    // Returns 200 if the process is alive.
+    //
+    // Body type is `String` (not `&str`) because `Reply` is only implemented
+    // for `&'static str`; using owned `String` avoids inferring a non-'static
+    // closure return type. The `.boxed()` on the final filter chain is the
+    // companion fix — without it, the warp 0.4 filter type carries a higher-
+    // ranked `AsRef<str>` bound that propagates through `tokio::spawn` and
+    // fails `Send + 'static`.
     let healthz = warp::path("healthz").map(move || {
         if health_state_healthz.is_healthy() {
-            warp::reply::with_status("OK", warp::http::StatusCode::OK)
+            warp::reply::with_status("OK".to_string(), warp::http::StatusCode::OK)
         } else {
             error!("Health check failed");
-            warp::reply::with_status("UNHEALTHY", warp::http::StatusCode::SERVICE_UNAVAILABLE)
+            warp::reply::with_status(
+                "UNHEALTHY".to_string(),
+                warp::http::StatusCode::SERVICE_UNAVAILABLE,
+            )
         }
     });
 
     // /readyz - Kubernetes readiness probe
-    // Returns 200 if the controller is ready to serve traffic
+    // Returns 200 if the controller is ready to serve traffic.
     let readyz = warp::path("readyz").map(move || {
         if health_state_readyz.is_ready() {
-            warp::reply::with_status("OK", warp::http::StatusCode::OK)
+            warp::reply::with_status("OK".to_string(), warp::http::StatusCode::OK)
         } else {
             debug!("Readiness check failed - controller not ready");
-            warp::reply::with_status("NOT READY", warp::http::StatusCode::SERVICE_UNAVAILABLE)
+            warp::reply::with_status(
+                "NOT READY".to_string(),
+                warp::http::StatusCode::SERVICE_UNAVAILABLE,
+            )
         }
     });
 
@@ -122,17 +135,18 @@ pub async fn start_health_server(port: u16, health_state: HealthState) {
         warp::reply::json(&status)
     });
 
-    // Legacy endpoints for backward compatibility
-    let health_legacy =
-        warp::path("health").map(|| warp::reply::with_status("OK", warp::http::StatusCode::OK));
-    let ready_legacy =
-        warp::path("ready").map(|| warp::reply::with_status("OK", warp::http::StatusCode::OK));
+    // Legacy endpoints for backward compatibility.
+    let health_legacy = warp::path("health")
+        .map(|| warp::reply::with_status("OK".to_string(), warp::http::StatusCode::OK));
+    let ready_legacy = warp::path("ready")
+        .map(|| warp::reply::with_status("OK".to_string(), warp::http::StatusCode::OK));
 
     let routes = healthz
         .or(readyz)
         .or(status)
         .or(health_legacy)
-        .or(ready_legacy);
+        .or(ready_legacy)
+        .boxed();
 
     warp::serve(routes).run(([0, 0, 0, 0], port)).await;
 }

src/health.rs

@@ -406,7 +406,7 @@ async fn run_metrics_server(port: u16) {
         }
     });
 
-    warp::serve(metrics).run(([0, 0, 0, 0], port)).await;
+    warp::serve(metrics.boxed()).run(([0, 0, 0, 0], port)).await;
 }
 
 #[cfg(test)]