Cargo deny fix

.omo/run-continuation/ses_fa68cd6a7ffey9dPiMrqx8nxlG.json

@@ -1,10 +1,10 @@
 {
   "sessionID": "ses_fa68cd6a7ffey9dPiMrqx8nxlG",
-  "updatedAt": "2026-09-01T22:43:36.544Z",
+  "updatedAt": "2026-09-01T22:52:34.671Z",
   "sources": {
     "background-task": {
       "state": "idle",
-      "updatedAt": "2026-09-01T22:43:36.544Z"
+      "updatedAt": "2026-09-01T22:52:34.671Z"
     }
   }
 }

Cargo.lock

@@ -2050,9 +2050,9 @@ dependencies = [
 
 [[package]]
 name = "prometheus"
-version = "0.13.4"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d33c28a30771f7f96db69893f78b857f7450d7e0237e9c8fc6427a81bae7ed1"
+checksum = "3ca5326d8d0b950a9acd87e6a3f94745394f62e4dae1b1ee22b2bc0c394af43a"
 dependencies = [
  "cfg-if",
  "fnv",
@@ -2060,14 +2060,28 @@ dependencies = [
  "memchr",
  "parking_lot",
  "protobuf",
- "thiserror 1.0.69",
+ "thiserror 2.0.20",
 ]
 
 [[package]]
 name = "protobuf"
-version = "2.28.0"
+version = "3.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "106dd99e98437432fed6519dedecfade6a06a73bb7b2a1e019fdd2bee5778d94"
+checksum = "d65a1d4ddae7d8b5de68153b48f6aa3bba8cb002b243dbdbc55a5afbc98f99f4"
+dependencies = [
+ "once_cell",
+ "protobuf-support",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "protobuf-support"
+version = "3.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e36c2f31e0a47f9280fb347ef5e461ffcd2c52dd520d8e216b52f93b0b0d7d6"
+dependencies = [
+ "thiserror 1.0.69",
+]
 
 [[package]]
 name = "quick-xml"

Cargo.toml

@@ -70,4 +70,5 @@ axum = "0.8"
 tower = { version = "0.4", features = ["util"] }
 
 # Metrics (todo 18): Prometheus text exposition for /metrics.
-prometheus = "0.13"
+# 0.14 drops the protobuf dependency (RUSTSEC-2024-0437).
+prometheus = "0.14"

deny.toml

@@ -3,6 +3,12 @@
 
 [advisories]
 yanked = "deny"
+# Unmaintained, but compile-time proc-macros pinned by the Leptos 0.8 tree
+# with no upgrade path; not reachable with untrusted runtime input.
+ignore = [
+    "RUSTSEC-2024-0436", # paste (via tachys/leptos)
+    "RUSTSEC-2026-0173", # proc-macro-error2 (via leptos_macro/rstml)
+]
 
 [licenses]
 allow = [
@@ -14,6 +20,12 @@ allow = [
     "ISC",
     "Unicode-3.0",
     "Zlib",
+    # Permissive/public-domain licenses on transitive deps that cannot be
+    # substituted: base16 (leptos wasm_split), webpki-roots (reqwest),
+    # xxhash-rust (leptos server_fn).
+    "CC0-1.0",
+    "CDLA-Permissive-2.0",
+    "BSL-1.0",
 ]
 
 [bans]