chore(deps): bump tower-http from 0.6.11 to 0.7.0

[dependabot]

Bumps tower-http from 0.6.11 to 0.7.0.

Release notes

Sourced from tower-http's releases.

tower-http-0.7.0

Changes since 0.6.11

Added

• csrf: add cross-site request forgery (CSRF) protection middleware, porting the cross-origin protection scheme introduced in Go 1.25 (#699)

  use tower::ServiceBuilder;
  use tower_http::csrf::CsrfLayer;
  // Rejects cross-origin state-changing requests using Sec-Fetch-Site,
  // an Origin allow-list, and an Origin/Host fallback. No per-request
  // token state required.
  let layer = CsrfLayer::new().add_trusted_origin("https://example.com")?;
  let service = ServiceBuilder::new().layer(layer).service_fn(handler);

• timeout: add DeadlineBody for non-resetting body timeouts, applied via the new RequestBodyDeadlineLayer and ResponseBodyDeadlineLayer (#688)

  Unlike TimeoutBody, which resets its deadline on every frame, DeadlineBody caps the total time of a body transfer. A slow client trickling one byte at a time never trips an idle timeout but will trip a deadline.

  use std::time::Duration;
  use tower::ServiceBuilder;
  use tower_http::timeout::RequestBodyDeadlineLayer;
  // Abort the request body transfer after 30s total, regardless of how
  // frequently data arrives.
  let service = ServiceBuilder::new()
  .layer(RequestBodyDeadlineLayer::new(Duration::from_secs(30)))
  .service_fn(handler);

• fs: add strong ETag support to ServeDir, including If-Match and If-None-Match precondition handling per RFC 9110. 304 Not Modified responses now carry the ETag and Last-Modified validators (#691)

• fs: add a Backend trait to make ServeDir work with non-filesystem sources (e.g. embedded assets or object storage). The default TokioBackend preserves existing behavior. Use ServeDir::with_backend() to plug in custom implementations (#684)

  use tower_http::services::fs::ServeDir;
  // MyBackend implements tower_http::services::fs::Backend.
  // The default ServeDir::new() continues to use TokioBackend (local FS).
  let service = ServeDir::with_backend("assets", MyBackend::new());

• fs: add html_as_default_extension option to ServeDir, appending .html when the request path has no extension (#519)

• fs: add redirect_path_prefix option to ServeDir, prepending a prefix on trailing-slash redirects so the service can be mounted under a sub-path (#486)

• validate-request: add ValidateRequestHeaderLayer::has_header_value() to reject requests when a header does not have an expected value (#360)

• body: UnsyncBoxBody::new() constructor and From<ServeFileSystemResponseBody> conversion to avoid double-boxing when combining ServeDir responses with other body types (#537)

• limit: implement Default for limit::ResponseBody when the wrapped body also implements Default (#679)

Changed

... (truncated)

Commits

• b194fcf v0.7.0
• af828a6 feat(follow_redirect)!: preserve request extensions across redirects (#706)
• 8cb8d99 feat(ValidateRequestHeaderLayer): add has_header("...").with_value("...") fun...
• 3b56d2d feat!: Add configurable Backend trait for ServeDir, bump MSRV 1.65 (#684)
• 8508716 Add redirect_path_prefix option (#486)
• 56327b2 Add Windows drive-prefix path regression test (#705)
• 54c6db8 feat(compression)!: upgrade SizeAbove threshold from u16 to u64 (#704)
• 68cd6d8 Add DeadlineBody for non-resetting body timeouts (#688)
• fa8a98c feat(fs): add strong ETag support to ServeDir (#691)
• 36d2205 fix: Make SetMultiple*Header Clone for !Clone http bodies (#703)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Thanks @dependabot[bot] for taking the time to contribute.

This repository is observing a maintainer-managed PR intake gate in dry-run mode, so this pull request is staying open. This note helps maintainers prepare the allowlist before any enforcement is considered.

Please read CONTRIBUTING.md for the expected contribution shape. A maintainer can grant recurring PR access by commenting /lgtm on a pull request.

[claude]

Claude finished @Hmbown's task in 1m 7s —— View job

---

Review: bump tower-http 0.6.11 → 0.7.0 (dependabot, #5387)

• Gather context and read diff
• Check for provider/model/route safety impact
• Check Cargo.toml / Cargo.lock diff for correctness
• Check for usages of tower-http APIs affected by breaking changes
• Post final review

Scope: Cargo.toml (+1/-1) and Cargo.lock (+19/-4) only — no source changes.

Findings:

1. Correctness / compilation — Both consumers of tower-http in this workspace (crates/app-server/src/lib.rs:31 and crates/tui/src/runtime_api.rs:37) only use the cors feature (CorsLayer::new().allow_origin(...).allow_methods(...), crates/app-server/src/lib.rs:744 and crates/tui/src/runtime_api.rs:6215). None of 0.7.0's breaking changes apply to this workspace:

   • follow_redirect extension-preservation change (feature not enabled)
   • ValidateRequestHeaderLayer additions (not used)
   • fs::ServeDir Backend trait / MSRV 1.65 bump (not used; workspace rust-version is already 1.88, Cargo.toml:35)
   • compression SizeAbove u16→u64 (not used)

   The Cargo.lock diff cleanly reflects the version bump for the two workspace crates that depend on tower-http directly (now 0.7.0), while reqwest's transitive tower-http 0.6.11 dependency is correctly left untouched — this is expected and not a problem (both versions coexist fine).

2. Provider/model/route safety (EPIC v0.8.65 EPIC: Separate provider facts, model facts, offerings, and route resolution #2608) — N/A, this diff touches only HTTP middleware dependency versions, no model/provider selection logic.

3. Reuse/simplification — N/A, dependency bump only.

4. Tests — Existing CORS tests (crates/tui/src/runtime_api/tests.rs) already exercise CorsLayer behavior (origin allow/deny) and aren't affected by this bump; no new coverage needed for a pure dependency update.

5. Security — No secret handling or exec policy changes. The dependency bump doesn't touch any allow/deny-listed crate policy.

Note: I was unable to run cargo build/cargo check/cargo test in this sandbox (build commands required approval not available in this automated context), so this review is based on static source analysis of the two tower_http::cors::CorsLayer call sites plus the published 0.7.0 changelog. Given the diff is lockfile + one version bump with no source changes, and the only feature used (cors) is unaffected by the documented breaking changes, this looks safe to merge — but CI's own build/test run should be treated as the authoritative gate per AGENTS.md.

No blocking issues found.

[Hmbown]

Triage: this bump is not actually blocked by tower-http.

The macOS run failed on exactly one test out of 12,881:

FAIL qa_pty::semantic_activity_motion_crosses_reasoning_reading_and_tool_use_in_a_real_unix_pty
Summary [726.228s] 12881 tests run: 12880 passed, 1 failed, 17 skipped

That is the known PTY activity-motion flake, not a tower-http 0.6 → 0.7 regression — nothing in this diff touches the TUI activity pipeline.

The v0.9.10 release lane (#5513) carries the fixes for that flake class: a stall watchdog and bounded PTY step (#5496), the 8 MiB test-thread stack that stops the lib suite aborting under load, and the fixture-race isolation work. Holding this PR until #5513 lands, then rebasing and re-running — it should go green without a code change.

[Hmbown]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.