chore: update dependencies 2026-08-03

[fiskus]

Sweeps every workspace dependency to its latest release (cargo upgrade --incompatible + cargo update) and the UI's npm lockfile, ahead of the QuiltSync v0.20.1 release.

Bumps

Manifests: base64 0.22 → 0.23, aws-config 1.9 → 1.10.1, aws-sdk-s3 1.138.1 → 1.140.0, aws-types 1.4 → 1.5, clap 4.6.2 → 4.6.5, jsonschema 0.48.1 → 0.49.3, tokio 1.53.0 → 1.53.1, tokio-stream 0.1.18 → 0.1.19, sentry 0.48.5 → 0.49.1, serial_test 3 → 4, leptos_router 0.8.14 → 0.8.15.

Lockfiles: 35 transitive crates; npm vanilla-jsoneditor 3.11 → 3.13. Two transitive crates stay behind latest (crypto-common, proc-macro-crate) — held back by upstream requirements.

Source changes the bumps forced

sentry 0.49 makes ClientOptions #[non_exhaustive], so neither struct expression in telemetry/sentry.rs compiles any more (E0639 — functional-update syntax is barred too). It is now built through the new setters. dsn stays a direct field assignment because the dsn setter takes a &str and panics on a malformed value, where get_sentry_dsn warns and disables Sentry instead.

clippy.toml's future-size-threshold moves 18500 → 19800. The fatter AWS SDK / reqwest / Tauri / Sentry state machines shifted the whole command-future cluster from ~18.4 KB to ~19.7 KB, tripping large_futures in 23 places. Boxing instead would have meant Box::pin at ~20 call sites, 16 of them in quilt-cli tests — the whack-a-mole trade-off clippy.toml already documents. Boxing the two app-side outliers first was tried; it only exposed the rest of the shifted cluster.

Verification

Every CI gate run locally on this branch, rebased onto main:

• cargo fmt --all -- --check
• just lint — native + wasm, zero large_futures at the new budget
• cargo nextest run --workspace --all-targets --exclude quilt-sync --exclude quilt-sync-ui — 597 passed
• cargo nextest run in quilt-sync/src-tauri — 281 passed
• cargo test --doc — pass
• just test-frontend — 40 wasm tests passed
• trunk build --release — pass
• cargo deny check — advisories, bans, licenses, sources ok

Every deny.toml advisory ignore is still live — checked by temporarily setting unused-ignored-advisory = "warn", which reported no advisory-not-detected. Nothing to prune.

Open Renovate PRs covering these crates (#757, #775, #777, #778, #779, #792, #794, #801, #805, #806) are subsumed by this sweep but left open deliberately.

🤖 Generated with Claude Code

Greptile Summary

The PR updates workspace Rust and frontend dependencies ahead of QuiltSync v0.20.1, adapts Sentry configuration to its non-exhaustive options API, and adjusts the large-future lint budget for dependency-driven growth.

• Updates direct and transitive Cargo dependencies, including AWS, Sentry, JSON Schema, Tokio, Clap, and Leptos Router.
• Refreshes the UI npm lockfile, including vanilla-jsoneditor and related packages.
• Preserves Sentry host tagging, release metadata, and tolerant DSN parsing through the new builder-style API.
• Raises the documented Clippy future-size threshold from 18,500 to 19,800 bytes.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code defect identified.

The Sentry migration preserves the existing configuration values, the dependency manifests and lockfiles remain internally consistent, and the investigated security advisories belong to unchanged, explicitly acknowledged transitive dependencies.

Important Files Changed

Filename	Overview
Cargo.toml	Updates workspace dependency constraints without a concrete compatibility or runtime defect identified.
Cargo.lock	Refreshes direct and transitive Rust dependencies; advisory-bearing legacy dependencies examined during review were unchanged.
clippy.toml	Raises and documents the large-future threshold to accommodate dependency-driven state-machine growth.
quilt-sync/src-tauri/Cargo.toml	Upgrades Sentry and the test-only serial_test dependency without an identified manifest inconsistency.
quilt-sync/src-tauri/src/telemetry/sentry.rs	Migrates non-exhaustive Sentry client options to setters while retaining the parsed DSN assignment and event host tagging.
quilt-sync/ui/Cargo.toml	Applies a patch-level Leptos Router update with no source-contract change required.
quilt-sync/ui/package-lock.json	Refreshes frontend dependency resolutions consistently, with no concrete editor or build integration regression identified.

_{Reviews (1): Last reviewed commit: "chore: update dependencies 2026-08-03" | Re-trigger Greptile}

Context used:

• Knowledge Base — QuiltSync desktop backend (src-tauri)
• Knowledge Base — Quilt Sync UI (Yew-era name, actually Leptos/WASM frontend)