[inureyes]

Brings dependencies to latest before v0.8.0. pnpm moves from 11.18.0 to 12.16.1, with the pins in package.json, ci.yml, build_bundle.py, the bundle manifest and the docs updated. cargo deny advisories pass, and the stale RUSTSEC-2026-0202 ignore is removed because cxx 1.0.205 no longer matches it.

Major bumps and migrations

Package	Version	Migration
axum, tower, tower-http	0.7 to 0.8, 0.4 to 0.5, 0.5 to 0.7	Routes use {id} and {*path}. URLs are unchanged. --api-prefix values containing { or } are now refused, since axum would panic on them.
reqwest	0.12 to 0.13	rustls-no-provider, with ring installed by src/http_tls.rs. No aws-lc-rs in the build.
sha2	0.10 to 0.11	Digests no longer format as hex; src/sha256_hex.rs replaces {:x}.
symphonia	0.5 to 0.6	New decoding API; gapless trimming stays off, so sample output is unchanged.
minijinja	2 to 3	Value::from(Serde(..)), and whitespace settings in SyntaxConfig.
tokenizers, serde-saphyr, rcgen, criterion	0.23, 2, 0.14, 0.8	API updates.
safetensors, toml, lz4_flex, rustyline, dirs, fancy-regex, base64, sentencepiece, tokio-tungstenite	latest	No code change.
lucide-react, TypeScript, @types/node, others	1.66, 6.0.3, 26	Site brand icons moved to brand-icons.tsx, lockfile tests read pnpm 12's last document.

Behavior changes

• HTTPS through reqwest now verifies against the OS trust store instead of bundled webpki roots. MLXCEL_EXTRA_CA_CERTS still applies. hf-hub keeps its own stack.
• minijinja 3 changes template semantics: a list or dict rendered directly uses Python quoting, // and % floor, round is half-even, and division by zero is an error. No output changed on the checkpoints below; a template outside them could differ.

WebUI fixes exposed by the bumps

• A failed route chunk could leave an empty page, because each render gave use() a new promise. A failed chunk now stays failed and reaches the reload banner.
• axe 4.14 flagged the brand link and loaded-model chip names under WCAG 2.5.3. The monogram moved to CSS, and the chip's visible text now matches its name.

Held back

• hf-hub 0.5: 1.0 forces aws-lc-rs through hf-xet and has no sync API. This keeps reqwest 0.12 and native-tls in the graph, as before.
• TypeScript 6.0.3: typescript-eslint 8.72 requires below 6.1.
• Transitive, pinned by parents: matchit (axum), generic-array (crypto-common).
• minimatch in webpage/site: 1 moderate advisory through eslint's own requirement, dev only. WebUI production dependencies have no advisory.

Validation

• make verify: 14917 passed, 0 failed. WebUI unit 777, Chromium 128, engine smoke 21, bundle reproducibility, and site build and lint pass.
• 12 real checkpoints against the previous build: identical generate output, /apply-template with and without tools, and /tokenize.
• HTTPS download through the new client, and acceptance test 3 at 2.019x.

Not validated locally: Windows and Linux builds (left to CI), mlxcel-xla under iree and spike/iree-ffi (need IREE_DIST).