build(deps): 升级rusqlite 0.41、rio-vt 0.5.29与rmcp 3.9修安全通告

Cargo.toml

@@ -30,14 +30,18 @@ version = "0.9.12"
 edition = "2024"
 # Rust 1.88 stabilized `let_chains` in `if`/`while` conditions, which the
 # codebase relies on extensively. Cargo enforces this so users on older
-# toolchains get a clear "package requires rustc 1.88+" error instead of a
+# toolchains get a clear "package requires rustc 1.89+" error instead of a
 # confusing E0658 from rustc.
 #
-# Lock-held for this MSRV: aes is deliberately kept at 0.9.2 in Cargo.lock;
-# 0.9.3 (what secret-service's crypto-rust pulls on a bare `cargo update`)
-# declares rust-version 1.89. Re-examine when secret-service drops its aes
-# 0.9 requirement or the workspace MSRV reaches 1.89.
-rust-version = "1.88"
+# The declared floor must match the lock graph: uuid 1.29.0 (in Cargo.lock
+# since before the 2026-11 advisory upgrades) already declares
+# rust-version 1.89, and rusqlite 0.41.1 adds the same floor, so a 1.88
+# toolchain fails on the lock itself no matter what this workspace declares.
+# The former "hold aes at 0.9.2 to keep 1.88" stance is therefore no longer
+# load-bearing for the MSRV (the aes pin stays for its own reproducibility
+# reasons); going back down requires the whole locked graph to drop every
+# 1.89-requiring crate, not just this declaration.
+rust-version = "1.89"
 license = "MIT"
 repository = "https://github.com/Hmbown/CodeWhale"
 
@@ -65,7 +69,7 @@ reqwest = { version = "0.13.1", default-features = false, features = ["json", "r
 # multi-thread engine over channels (see crates/workflow-js).
 rquickjs = { version = "0.12", features = ["futures"] }
 rustls = { version = "0.23.36", default-features = false, features = ["ring", "std", "tls12"] }
-rusqlite = { version = "0.40.2", features = ["bundled"] }
+rusqlite = { version = "0.41.0", features = ["bundled"] }
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.149"
 semver = "1.0.28"