Cargo.lock only, all semver-compatible. Clears every `cargo audit` vulnerability: quinn-proto 0.11.13 -> 0.11.19 rustls 0.23.37 -> 0.23.46 rustls-webpki 0.103.9 -> 0.103.16 tar 0.4.44 -> 0.4.46 webpki-roots 1.0.6 -> 1.0.11 webpki-root-certs 1.0.9 -> 1.0.11 plist 1.8.0 -> 1.10.0 (quick-xml 0.38.4 -> 0.41.0) Also clears these "unsound" warnings: tokio 1.49.0 -> 1.54.1, anyhow -> 1.0.104, event-listener -> 5.4.2, rand 0.8.5 -> 0.8.8 and 0.9.2 -> 0.9.5. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>