Clears RUSTSEC-2026-0190 (anyhow 1.0.102, unsoundness in
Error::downcast_mut, patched >= 1.0.103) by taking anyhow 1.0.104.
`cargo audit` is clean afterwards.
Also drops the WASM component toolchain from the tree — wit-bindgen,
wit-component, wit-parser, wasm-encoder, wasmparser, wasm-metadata,
wasip2/wasip3 — which entered via tempfile -> getrandom 0.4.2 and go
away with getrandom 0.4.3. 153 -> 129 crate dependencies.
Notable: tokio 1.52.3 -> 1.53.1. The stdin keep-open work depends on
Child::wait() dropping its own stdin handle; the RealChild test covers
that and still passes.
etcetera 0.10 -> 0.11 and nix 0.30 -> 0.31 are deliberately NOT taken
here: both need manifest edits, and both are load-bearing (XDG path
resolution, setpgid and signals).
143 tests pass, clippy clean.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TWLFEoRaRafJm1SpdhWQ6F
Three review findings on task 4:
- read_plist_fields now parses the plist properly via the plist crate
(already a transitive dep of service-manager, promoted to direct) instead
of slicing raw XML, so a PATH or program path containing & or < no longer
round-trips as literal &/< through cli::service::render_status.
- launchctl's error path now includes both stdout and stderr, trimmed and
joined only on non-empty parts, so a failure never surfaces as
"launchctl load failed: " with nothing after the colon.
- status() now returns identical None fields (program, path_env,
snapshotted, pid) whether the plist is absent or the plist exists but the
crate reports NotInstalled (e.g. written but never loaded, or booted out
of band) - extracted via a shared not_installed_status/build_status split
so both paths run the same code.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EGntTHCW3sEPy1VBRopNNp
logaritmiskandClaude Opus 5