From ca52d29de46ca51e237bc7034dc5a2b52d296e11 Mon Sep 17 00:00:00 2001
From: Frank Schwichtenberg <frank.schwichtenberg@intersystems.com>
Date: Wed, 4 Nov 2026 17:17:59 -0500
Subject: [PATCH 1/4] chore(deps): windows 0.62, rusqlite 0.41, aes-gcm 0.11,
 dirs 7, ctor 1

Rolls up Dependabot #159, #160, #173, #178 and #179.

- ctor 1 refuses a constructor without the unsafe acknowledgement, so every #[ctor::ctor] is now #[ctor::ctor(unsafe)]. They are the test-isolation hooks; what they run is unchanged.
- aes-gcm 0.11 deprecates from_slice. The safeStorage decrypt converts the key and nonce with TryFrom; both lengths are checked first, and a failed conversion is an error, not a panic. The test helper that seals fixtures uses From on its fixed-size arrays.
- windows 0.62 passes optional arguments as Option: GetUserNameW and LocalFree take Some(..). CryptUnprotectData is unchanged.
- rusqlite 0.41 and dirs 7 build without code changes.
- The payload test's fixture value is renamed so the staged-file secret scan does not read it as a credential; the test is unchanged.

The Windows paths compile only on the Windows runner; windows-handshake and its DPAPI round-trip step cover them.
---
 Cargo.lock                                    | 489 ++++++++----------
 crates/iris-agentic-dev-bin/Cargo.toml        |   6 +-
 crates/iris-agentic-dev-bin/src/lib.rs        |   4 +-
 .../tests/integration/main.rs                 |   2 +-
 crates/iris-agentic-dev-bin/tests/main.rs     |   2 +-
 .../iris-agentic-dev-bin/tests/unit/main.rs   |   2 +-
 crates/iris-agentic-dev-core/Cargo.toml       |  10 +-
 .../src/iris/server_manager.rs                |   6 +-
 .../src/iris/vscode_payload.rs                |  19 +-
 crates/iris-agentic-dev-core/src/lib.rs       |   2 +-
 .../tests/binary/main.rs                      |   2 +-
 .../tests/integration/main.rs                 |   2 +-
 crates/iris-agentic-dev-core/tests/main.rs    |   2 +-
 .../iris-agentic-dev-core/tests/unit/main.rs  |   2 +-
 .../tests/unit/test_vscode_payload.rs         |  18 +-
 15 files changed, 248 insertions(+), 320 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index a4340244..70840329 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4,23 +4,12 @@ version = 4
 
 [[package]]
 name = "aead"
-version = "0.5.2"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+checksum = "1973cfbc1a2daf9cf550e74e1f088c28e7f7d8c1e1418fb6c9dc5184b7e84c99"
 dependencies = [
- "crypto-common 0.1.7",
- "generic-array",
-]
-
-[[package]]
-name = "aes"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
-dependencies = [
- "cfg-if",
- "cipher 0.4.4",
- "cpufeatures 0.2.17",
+ "crypto-common",
+ "inout",
 ]
 
 [[package]]
@@ -29,35 +18,23 @@ version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "35f0f96ce78e38c3dc6d8948aa8163d06385be74000f3c7a95bf1eef35d3ea32"
 dependencies = [
- "cipher 0.5.2",
+ "cipher",
  "cpubits",
- "cpufeatures 0.3.1",
+ "cpufeatures",
 ]
 
 [[package]]
 name = "aes-gcm"
-version = "0.10.3"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
+checksum = "7f2b8006a0c83f52b62ba44a97b58bf76fe2f70a329e588f67f89691d93d498f"
 dependencies = [
  "aead",
- "aes 0.8.4",
- "cipher 0.4.4",
+ "aes",
+ "cipher",
  "ctr",
+ "ctutils",
  "ghash",
- "subtle",
-]
-
-[[package]]
-name = "ahash"
-version = "0.8.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
-dependencies = [
- "cfg-if",
- "once_cell",
- "version_check",
- "zerocopy",
 ]
 
 [[package]]
@@ -371,7 +348,7 @@ dependencies = [
  "serde_derive",
  "serde_json",
  "serde_urlencoded",
- "thiserror 2.0.21",
+ "thiserror",
  "tokio",
  "tokio-util",
  "tower-service",
@@ -414,7 +391,7 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce2dc9ee5f88d11e0beb842c88b33c8a5cf0d1329c4b19494af42b07dbfe8896"
 dependencies = [
- "cipher 0.5.2",
+ "cipher",
 ]
 
 [[package]]
@@ -446,8 +423,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.3.1",
- "rand_core 0.10.1",
+ "cpufeatures",
+ "rand_core",
 ]
 
 [[package]]
@@ -464,24 +441,15 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "cipher"
-version = "0.4.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
-dependencies = [
- "crypto-common 0.1.7",
- "inout 0.1.4",
-]
-
 [[package]]
 name = "cipher"
 version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
 dependencies = [
- "crypto-common 0.2.2",
- "inout 0.2.5",
+ "block-buffer",
+ "crypto-common",
+ "inout",
 ]
 
 [[package]]
@@ -602,15 +570,6 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
 
-[[package]]
-name = "cpufeatures"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "cpufeatures"
 version = "0.3.1"
@@ -626,43 +585,34 @@ version = "0.8.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6"
 
-[[package]]
-name = "crypto-common"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
-dependencies = [
- "generic-array",
- "rand_core 0.6.4",
- "typenum",
-]
-
 [[package]]
 name = "crypto-common"
 version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
+ "getrandom 0.4.3",
  "hybrid-array",
+ "rand_core",
 ]
 
 [[package]]
 name = "ctor"
-version = "0.2.9"
+version = "1.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a2785755761f3ddc1492979ce1e48d2c00d09311c39e4466429188f3dd6501"
+checksum = "914a755b7c2d4af2bdcff7ce1739e2db9a1b81a9b07123d8015786ae03c0980d"
 dependencies = [
- "quote",
- "syn 2.0.119",
+ "link-section",
+ "linktime-proc-macro",
 ]
 
 [[package]]
 name = "ctr"
-version = "0.9.2"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+checksum = "baaca1c4b237092596f64d571e9db6ce4109c4ef9742e27590f1709594461f21"
 dependencies = [
- "cipher 0.4.4",
+ "cipher",
 ]
 
 [[package]]
@@ -746,29 +696,29 @@ checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
  "block-buffer",
  "const-oid",
- "crypto-common 0.2.2",
+ "crypto-common",
  "ctutils",
 ]
 
 [[package]]
 name = "dirs"
-version = "5.0.1"
+version = "7.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44c45a9d03d6676652bcb5e724c7e988de1acad23a711b5217ab9cbecbec2225"
+checksum = "8d57d423b3c82e89b9a24ca3091fee61f456a26edbd28d26c65906f4bc1dcd8f"
 dependencies = [
  "dirs-sys",
 ]
 
 [[package]]
 name = "dirs-sys"
-version = "0.4.1"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "520f05a5cbd335fae5a99ff7a6ab8627577660ee5cfd6a94a6a929b52ff0321c"
+checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
 dependencies = [
  "libc",
  "option-ext",
  "redox_users",
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1006,16 +956,6 @@ dependencies = [
  "slab",
 ]
 
-[[package]]
-name = "generic-array"
-version = "0.14.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
-dependencies = [
- "typenum",
- "version_check",
-]
-
 [[package]]
 name = "getrandom"
 version = "0.2.17"
@@ -1039,17 +979,16 @@ dependencies = [
  "js-sys",
  "libc",
  "r-efi",
- "rand_core 0.10.1",
+ "rand_core",
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "ghash"
-version = "0.5.1"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1"
+checksum = "2eecf2d5dc9b66b732b97707a0210906b1d30523eb773193ab777c0c84b3e8d5"
 dependencies = [
- "opaque-debug",
  "polyval",
 ]
 
@@ -1072,28 +1011,22 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "hashbrown"
-version = "0.14.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
-dependencies = [
- "ahash",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+dependencies = [
+ "foldhash",
+]
 
 [[package]]
 name = "hashlink"
-version = "0.9.1"
+version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ba4ff7128dee98c7dc9794b6a411377e1404dba1c97deb8d1a55297bd25d8af"
+checksum = "a596f1b20ed2cc5ecac41a164aaebc7258057060f06c0cf7a2ba3991ee7990fb"
 dependencies = [
- "hashbrown 0.14.5",
+ "hashbrown",
 ]
 
 [[package]]
@@ -1289,7 +1222,7 @@ dependencies = [
  "js-sys",
  "log",
  "wasm-bindgen",
- "windows-core",
+ "windows-core 0.58.0",
 ]
 
 [[package]]
@@ -1418,20 +1351,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
 dependencies = [
  "equivalent",
- "hashbrown 0.17.1",
+ "hashbrown",
  "serde",
  "serde_core",
 ]
 
-[[package]]
-name = "inout"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
-dependencies = [
- "generic-array",
-]
-
 [[package]]
 name = "inout"
 version = "0.2.5"
@@ -1502,7 +1426,7 @@ dependencies = [
  "serde_json",
  "similar",
  "tempfile",
- "thiserror 2.0.21",
+ "thiserror",
  "tokio",
  "tokio-rustls",
  "tokio-tungstenite",
@@ -1586,15 +1510,27 @@ dependencies = [
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.30.1"
+version = "0.39.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
+checksum = "14a5f01b87b92705d07b433c06f96cbc764637d81a0bffb5734ce17cf0f9a2b3"
 dependencies = [
  "cc",
  "pkg-config",
  "vcpkg",
 ]
 
+[[package]]
+name = "link-section"
+version = "0.19.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39c29a617ce3df32c08497bdc1ab6e2376e0b17948ac166a2fbe5977c5954cd9"
+
+[[package]]
+name = "linktime-proc-macro"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e57c38c1e860fd37c604281cdfb1dd2216977fd76a50f85ba2f388ef3219616"
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.12.1"
@@ -1778,12 +1714,6 @@ version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 
-[[package]]
-name = "opaque-debug"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
-
 [[package]]
 name = "openssl-probe"
 version = "0.2.1"
@@ -1886,13 +1816,12 @@ dependencies = [
 
 [[package]]
 name = "polyval"
-version = "0.6.2"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
+checksum = "f0fa31d631f2b2cb2a544d0aa321ce847a94764d701ca2becc411138b93d49cd"
 dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "opaque-debug",
+ "cpubits",
+ "cpufeatures",
  "universal-hash",
 ]
 
@@ -1968,7 +1897,7 @@ dependencies = [
  "rustc-hash",
  "rustls",
  "socket2",
- "thiserror 2.0.21",
+ "thiserror",
  "tokio",
  "tracing",
  "web-time",
@@ -1990,7 +1919,7 @@ dependencies = [
  "rustls",
  "rustls-pki-types",
  "slab",
- "thiserror 2.0.21",
+ "thiserror",
  "tinyvec",
  "tracing",
  "web-time",
@@ -2033,16 +1962,7 @@ checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af"
 dependencies = [
  "chacha20",
  "getrandom 0.4.3",
- "rand_core 0.10.1",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
-dependencies = [
- "getrandom 0.2.17",
+ "rand_core",
 ]
 
 [[package]]
@@ -2057,7 +1977,7 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
 dependencies = [
- "rand_core 0.10.1",
+ "rand_core",
 ]
 
 [[package]]
@@ -2071,13 +1991,12 @@ dependencies = [
 
 [[package]]
 name = "redox_users"
-version = "0.4.6"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43"
+checksum = "60dc65c0ff1a7ae1294b0c67b9f14baf70b644404010370171787bfac1038fc0"
 dependencies = [
- "getrandom 0.2.17",
  "libredox",
- "thiserror 1.0.69",
+ "thiserror",
 ]
 
 [[package]]
@@ -2206,7 +2125,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sse-stream",
- "thiserror 2.0.21",
+ "thiserror",
  "tokio",
  "tokio-stream",
  "tokio-util",
@@ -2228,11 +2147,20 @@ dependencies = [
  "syn 3.0.9",
 ]
 
+[[package]]
+name = "rsqlite-vfs"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "353b74f9810d5b085b6c42c9d86a5f0fdb795553235cdd48753b32e3809d18a7"
+dependencies = [
+ "thiserror",
+]
+
 [[package]]
 name = "rusqlite"
-version = "0.32.1"
+version = "0.41.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7753b721174eb8ff87a9a0e799e2d7bc3749323e773db92e0984debb00019d6e"
+checksum = "da9bba6f3506135e120a6586df05be18b48d18896600646a4bec8f993d91a594"
 dependencies = [
  "bitflags",
  "fallible-iterator",
@@ -2240,6 +2168,7 @@ dependencies = [
  "hashlink",
  "libsqlite3-sys",
  "smallvec",
+ "sqlite-wasm-rs",
 ]
 
 [[package]]
@@ -2367,7 +2296,7 @@ version = "5.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5107b24b91445dd2aa449a258a1807b63240942157292354dc5bfdbeb8bc6db8"
 dependencies = [
- "aes 0.9.3",
+ "aes",
  "cbc",
  "futures-util",
  "getrandom 0.4.3",
@@ -2508,7 +2437,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.3.1",
+ "cpufeatures",
  "digest",
 ]
 
@@ -2519,7 +2448,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "47d7069beb7d6ac7b9acd1039986e73443f24234f41074da099d6f994ac9ad19"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.3.1",
+ "cpufeatures",
  "digest",
 ]
 
@@ -2576,6 +2505,16 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "sqlite-wasm-rs"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36bd8e29bf08189a005b2df1df99823aa0861cabe9044e5f31ed54ca292ee618"
+dependencies = [
+ "cc",
+ "rsqlite-vfs",
+]
+
 [[package]]
 name = "sse-stream"
 version = "0.2.6"
@@ -2668,33 +2607,13 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "thiserror"
-version = "1.0.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
-dependencies = [
- "thiserror-impl 1.0.69",
-]
-
 [[package]]
 name = "thiserror"
 version = "2.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
 dependencies = [
- "thiserror-impl 2.0.21",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
+ "thiserror-impl",
 ]
 
 [[package]]
@@ -3063,7 +2982,7 @@ dependencies = [
  "rustls",
  "rustls-pki-types",
  "sha1",
- "thiserror 2.0.21",
+ "thiserror",
 ]
 
 [[package]]
@@ -3091,12 +3010,12 @@ checksum = "a2c754d6c33795a1c324727428e5a7dedb5b06195f9890bdbcba760d3e246563"
 
 [[package]]
 name = "universal-hash"
-version = "0.5.1"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+checksum = "f4987bdc12753382e0bec4a65c50738ffaabc998b9cdd1f952fb5f39b0048a96"
 dependencies = [
- "crypto-common 0.1.7",
- "subtle",
+ "crypto-common",
+ "ctutils",
 ]
 
 [[package]]
@@ -3289,12 +3208,23 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windows"
-version = "0.58.0"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "527fadee13e0c05939a6a05d5bd6eec6cd2e3dbd648b9f8e447c6518133d8580"
+dependencies = [
+ "windows-collections",
+ "windows-core 0.62.2",
+ "windows-future",
+ "windows-numerics",
+]
+
+[[package]]
+name = "windows-collections"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd04d41d93c4992d421894c18c8b43496aa748dd4c081bac0dc93eb0489272b6"
+checksum = "23b2d95af1a8a14a3c7367e1ed4fc9c20e0a26e79551b1454d72583c97cc6610"
 dependencies = [
- "windows-core",
- "windows-targets 0.52.6",
+ "windows-core 0.62.2",
 ]
 
 [[package]]
@@ -3303,11 +3233,35 @@ version = "0.58.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ba6d44ec8c2591c134257ce647b7ea6b20335bf6379a27dac5f1641fcf59f99"
 dependencies = [
- "windows-implement",
- "windows-interface",
- "windows-result",
- "windows-strings",
- "windows-targets 0.52.6",
+ "windows-implement 0.58.0",
+ "windows-interface 0.58.0",
+ "windows-result 0.2.0",
+ "windows-strings 0.1.0",
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement 0.60.2",
+ "windows-interface 0.59.3",
+ "windows-link",
+ "windows-result 0.4.1",
+ "windows-strings 0.5.1",
+]
+
+[[package]]
+name = "windows-future"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1d6f90251fe18a279739e78025bd6ddc52a7e22f921070ccdc67dde84c605cb"
+dependencies = [
+ "windows-core 0.62.2",
+ "windows-link",
+ "windows-threading",
 ]
 
 [[package]]
@@ -3321,6 +3275,17 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "windows-interface"
 version = "0.58.0"
@@ -3332,6 +3297,17 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "windows-link"
 version = "0.2.1"
@@ -3351,13 +3327,32 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "windows-numerics"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2e40844ac143cdb44aead537bbf727de9b044e107a0f1220392177d15b0f26"
+dependencies = [
+ "windows-core 0.62.2",
+ "windows-link",
+]
+
 [[package]]
 name = "windows-result"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d1043d8214f791817bab27572aaa8af63732e11bf84aa21a45a78d6c317ae0e"
 dependencies = [
- "windows-targets 0.52.6",
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
 ]
 
 [[package]]
@@ -3366,17 +3361,17 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4cd9b125c486025df0eabcb585e62173c6c9eddcec5d117d3b6e8c30e2ee4d10"
 dependencies = [
- "windows-result",
- "windows-targets 0.52.6",
+ "windows-result 0.2.0",
+ "windows-targets",
 ]
 
 [[package]]
-name = "windows-sys"
-version = "0.48.0"
+name = "windows-strings"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
 dependencies = [
- "windows-targets 0.48.5",
+ "windows-link",
 ]
 
 [[package]]
@@ -3385,7 +3380,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.6",
+ "windows-targets",
 ]
 
 [[package]]
@@ -3397,42 +3392,30 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "windows-targets"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
-dependencies = [
- "windows_aarch64_gnullvm 0.48.5",
- "windows_aarch64_msvc 0.48.5",
- "windows_i686_gnu 0.48.5",
- "windows_i686_msvc 0.48.5",
- "windows_x86_64_gnu 0.48.5",
- "windows_x86_64_gnullvm 0.48.5",
- "windows_x86_64_msvc 0.48.5",
-]
-
 [[package]]
 name = "windows-targets"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
  "windows_i686_gnullvm",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
 ]
 
 [[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.48.5"
+name = "windows-threading"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+checksum = "3949bd5b99cafdf1c7ca86b43ca564028dfe27d66958f2470940f73d86d75b37"
+dependencies = [
+ "windows-link",
+]
 
 [[package]]
 name = "windows_aarch64_gnullvm"
@@ -3440,24 +3423,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
@@ -3470,48 +3441,24 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
@@ -3660,26 +3607,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "zerocopy"
-version = "0.8.63"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5fe1f8f1b06191a00962174c61aa5005e0bb391a6d80d07e24d115c01a92ed8"
-dependencies = [
- "zerocopy-derive",
-]
-
-[[package]]
-name = "zerocopy-derive"
-version = "0.8.63"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "863ad3ac83293fb4d740aedbfdc9240dd8d1a50c1099acd76ce80ce7c7230c7f"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "zerofrom"
 version = "0.1.8"
diff --git a/crates/iris-agentic-dev-bin/Cargo.toml b/crates/iris-agentic-dev-bin/Cargo.toml
index 3bcdc3a7..e1064da5 100644
--- a/crates/iris-agentic-dev-bin/Cargo.toml
+++ b/crates/iris-agentic-dev-bin/Cargo.toml
@@ -38,7 +38,7 @@ anyhow.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 urlencoding = "2"
-dirs = "5"
+dirs = "7"
 tracing.workspace = true
 tracing-subscriber.workspace = true
 hyper = { version = "1", features = ["http1", "server"] }
@@ -58,11 +58,11 @@ name = "windows_sm_credential"
 path = "examples/windows_sm_credential.rs"
 
 [target.'cfg(target_os = "windows")'.dependencies]
-rusqlite = { version = "0.32", features = ["bundled"] }
+rusqlite = { version = "0.41", features = ["bundled"] }
 
 [dev-dependencies]
 # Runs `testing::isolate_process` before `main` in every test target (spec 141 T183).
-ctor = "0.2"
+ctor = "1"
 tempfile = "3"
 serde_json.workspace = true
 
diff --git a/crates/iris-agentic-dev-bin/src/lib.rs b/crates/iris-agentic-dev-bin/src/lib.rs
index 37e3f783..5e6accf0 100644
--- a/crates/iris-agentic-dev-bin/src/lib.rs
+++ b/crates/iris-agentic-dev-bin/src/lib.rs
@@ -17,7 +17,7 @@ pub fn exit(code: i32) -> ! {
 #[cfg(test)]
 mod test_isolation {
     #[cfg(feature = "testing")]
-    #[ctor::ctor]
+    #[ctor::ctor(unsafe)]
     fn isolate_the_lib_test_process() {
         iris_agentic_dev_core::testing::isolate_process();
     }
@@ -27,7 +27,7 @@ mod test_isolation {
     // build these tests. They get the two settings of `isolate_process` that keep a test off the
     // developer's files and keychain: an empty `HOME` and `IAD_NO_KEYCHAIN=1`.
     #[cfg(not(feature = "testing"))]
-    #[ctor::ctor]
+    #[ctor::ctor(unsafe)]
     fn isolate_the_lib_test_process() {
         let home = std::env::temp_dir().join(format!("iad-bin-lib-test-{}", std::process::id()));
         let _ = std::fs::create_dir_all(&home);
diff --git a/crates/iris-agentic-dev-bin/tests/integration/main.rs b/crates/iris-agentic-dev-bin/tests/integration/main.rs
index 63165eaa..da5550ff 100644
--- a/crates/iris-agentic-dev-bin/tests/integration/main.rs
+++ b/crates/iris-agentic-dev-bin/tests/integration/main.rs
@@ -13,7 +13,7 @@
 
 // Runs before `main`, so before any test thread: no test in this binary reaches the developer's
 // real keychain or home directory. See `testing::isolate_process`.
-#[ctor::ctor]
+#[ctor::ctor(unsafe)]
 fn isolate_the_test_process() {
     iris_agentic_dev_core::testing::isolate_process();
 }
diff --git a/crates/iris-agentic-dev-bin/tests/main.rs b/crates/iris-agentic-dev-bin/tests/main.rs
index 5d766c13..710eb6d9 100644
--- a/crates/iris-agentic-dev-bin/tests/main.rs
+++ b/crates/iris-agentic-dev-bin/tests/main.rs
@@ -9,7 +9,7 @@
 
 // Runs before `main`, so before any test thread: no test in this binary reaches the developer's
 // real keychain or home directory. See `testing::isolate_process`.
-#[ctor::ctor]
+#[ctor::ctor(unsafe)]
 fn isolate_the_test_process() {
     iris_agentic_dev_core::testing::isolate_process();
 }
diff --git a/crates/iris-agentic-dev-bin/tests/unit/main.rs b/crates/iris-agentic-dev-bin/tests/unit/main.rs
index d845ad4f..72956f51 100644
--- a/crates/iris-agentic-dev-bin/tests/unit/main.rs
+++ b/crates/iris-agentic-dev-bin/tests/unit/main.rs
@@ -11,7 +11,7 @@
 
 // Runs before `main`, so before any test thread: no test in this binary reaches the developer's
 // real keychain or home directory. See `testing::isolate_process`.
-#[ctor::ctor]
+#[ctor::ctor(unsafe)]
 fn isolate_the_test_process() {
     iris_agentic_dev_core::testing::isolate_process();
 }
diff --git a/crates/iris-agentic-dev-core/Cargo.toml b/crates/iris-agentic-dev-core/Cargo.toml
index 30429750..986facdf 100644
--- a/crates/iris-agentic-dev-core/Cargo.toml
+++ b/crates/iris-agentic-dev-core/Cargo.toml
@@ -35,7 +35,7 @@ tracing.workspace = true
 urlencoding = "2"
 chrono = { version = "0.4", features = ["serde"] }
 uuid = { version = "1", features = ["v4", "serde"] }
-dirs = "5"
+dirs = "7"
 keyring = { version = "4.2", features = ["v1"] }
 keyring-core = { version = "1" }
 tree-sitter = "0.26"
@@ -45,7 +45,7 @@ quick-xml = "0.41"
 tokio-tungstenite = { version = "0.30", features = ["rustls-tls-native-roots", "connect", "handshake"], default-features = false }
 futures-util = { version = "0.3", features = ["sink"] }
 base64 = "0.22"
-aes-gcm = "0.10"
+aes-gcm = "0.11"
 similar = "2"
 
 
@@ -60,8 +60,8 @@ apple-native-keyring-store = "1"
 
 [target.'cfg(target_os = "windows")'.dependencies]
 windows-native-keyring-store = "1"
-rusqlite = { version = "0.32", features = ["bundled"] }
-windows = { version = "0.58", features = ["Win32_Security_Cryptography", "Win32_Foundation", "Win32_System_WindowsProgramming"] }
+rusqlite = { version = "0.41", features = ["bundled"] }
+windows = { version = "0.62", features = ["Win32_Security_Cryptography", "Win32_Foundation", "Win32_System_WindowsProgramming"] }
 
 [target.'cfg(all(unix, not(any(target_os = "macos", target_os = "ios", target_os = "android"))))'.dependencies]
 zbus-secret-service-keyring-store = { version = "1", features = ["crypto-rust"] }
@@ -69,7 +69,7 @@ zbus-secret-service-keyring-store = { version = "1", features = ["crypto-rust"]
 # Test dependencies
 [dev-dependencies]
 # Runs `testing::isolate_process` before `main` in every test target (spec 141 T183).
-ctor = "0.2"
+ctor = "1"
 tokio = { workspace = true, features = ["full"] }
 tempfile = "3"
 serde_json.workspace = true
diff --git a/crates/iris-agentic-dev-core/src/iris/server_manager.rs b/crates/iris-agentic-dev-core/src/iris/server_manager.rs
index c79c01d1..34a6de68 100644
--- a/crates/iris-agentic-dev-core/src/iris/server_manager.rs
+++ b/crates/iris-agentic-dev-core/src/iris/server_manager.rs
@@ -769,7 +769,7 @@ fn current_windows_username() -> Option<String> {
     use windows::Win32::System::WindowsProgramming::GetUserNameW;
     let mut buf = vec![0u16; 257];
     let mut size = buf.len() as u32;
-    let ok = unsafe { GetUserNameW(PWSTR(buf.as_mut_ptr()), &mut size) };
+    let ok = unsafe { GetUserNameW(Some(PWSTR(buf.as_mut_ptr())), &mut size) };
     if ok.is_err() {
         return None;
     }
@@ -809,9 +809,9 @@ fn vscdb_dpapi_decrypt(ciphertext: &[u8], what: &str) -> Result<Vec<u8>, String>
     let decrypted =
         unsafe { std::slice::from_raw_parts(output.pbData, output.cbData as usize).to_vec() };
     unsafe {
-        windows::Win32::Foundation::LocalFree(windows::Win32::Foundation::HLOCAL(
+        windows::Win32::Foundation::LocalFree(Some(windows::Win32::Foundation::HLOCAL(
             output.pbData as *mut _,
-        ));
+        )));
     }
     Ok(decrypted)
 }
diff --git a/crates/iris-agentic-dev-core/src/iris/vscode_payload.rs b/crates/iris-agentic-dev-core/src/iris/vscode_payload.rs
index b19d34ab..d11796ff 100644
--- a/crates/iris-agentic-dev-core/src/iris/vscode_payload.rs
+++ b/crates/iris-agentic-dev-core/src/iris/vscode_payload.rs
@@ -208,7 +208,7 @@ pub fn parse_local_state_key(local_state_json: &str) -> Result<Vec<u8>, String>
 /// Open a `v10`/`v11` envelope with the unsealed AES-256 key.
 pub fn decrypt_safe_storage(envelope: &[u8], aes_key: &[u8]) -> Result<String, String> {
     use aes_gcm::aead::{Aead, KeyInit};
-    use aes_gcm::{Aes256Gcm, Key, Nonce};
+    use aes_gcm::{Aes256Gcm, Key};
 
     if aes_key.len() != 32 {
         return Err(format!(
@@ -232,15 +232,18 @@ pub fn decrypt_safe_storage(envelope: &[u8], aes_key: &[u8]) -> Result<String, S
     let nonce = &envelope[ENVELOPE_TAG_LEN..ENVELOPE_TAG_LEN + GCM_NONCE_LEN];
     let sealed = &envelope[ENVELOPE_TAG_LEN + GCM_NONCE_LEN..];
 
-    let cipher = Aes256Gcm::new(Key::<Aes256Gcm>::from_slice(aes_key));
-    let plaintext = cipher
-        .decrypt(Nonce::from_slice(nonce), sealed)
-        .map_err(|_| {
-            "AES-GCM authentication failed — the Local State key does not match this \
+    // Both lengths were checked above, so neither conversion fails; an error stays an error.
+    let key = Key::<Aes256Gcm>::try_from(aes_key)
+        .map_err(|_| format!("AES-256 key is {} bytes, not 32", aes_key.len()))?;
+    let nonce = aes_gcm::aead::Nonce::<Aes256Gcm>::try_from(nonce)
+        .map_err(|_| format!("GCM nonce is {} bytes, not {GCM_NONCE_LEN}", nonce.len()))?;
+    let cipher = Aes256Gcm::new(&key);
+    let plaintext = cipher.decrypt(&nonce, sealed).map_err(|_| {
+        "AES-GCM authentication failed — the Local State key does not match this \
              value. The credential may have been written by a different VS Code \
              install, or Local State was replaced after the secret was stored."
-                .to_string()
-        })?;
+            .to_string()
+    })?;
 
     String::from_utf8(plaintext).map_err(|e| format!("decrypted bytes are not UTF-8: {e}"))
 }
diff --git a/crates/iris-agentic-dev-core/src/lib.rs b/crates/iris-agentic-dev-core/src/lib.rs
index 52b71f71..6f7fe3b5 100644
--- a/crates/iris-agentic-dev-core/src/lib.rs
+++ b/crates/iris-agentic-dev-core/src/lib.rs
@@ -19,7 +19,7 @@ pub mod testing;
 // The unit tests inside `src/` run in their own binary, which no aggregator's `main.rs` reaches.
 // Same reason as the aggregators: isolate before `main` (spec 141 T183).
 #[cfg(all(test, feature = "testing"))]
-#[ctor::ctor]
+#[ctor::ctor(unsafe)]
 fn isolate_the_lib_test_process() {
     testing::isolate_process();
 }
diff --git a/crates/iris-agentic-dev-core/tests/binary/main.rs b/crates/iris-agentic-dev-core/tests/binary/main.rs
index b2c3c25c..420c1757 100644
--- a/crates/iris-agentic-dev-core/tests/binary/main.rs
+++ b/crates/iris-agentic-dev-core/tests/binary/main.rs
@@ -9,7 +9,7 @@
 
 // Runs before `main`, so before any test thread: no test in this binary reaches the developer's
 // real keychain or home directory. See `testing::isolate_process`.
-#[ctor::ctor]
+#[ctor::ctor(unsafe)]
 fn isolate_the_test_process() {
     iris_agentic_dev_core::testing::isolate_process();
 }
diff --git a/crates/iris-agentic-dev-core/tests/integration/main.rs b/crates/iris-agentic-dev-core/tests/integration/main.rs
index c96c5c8f..e71c993d 100644
--- a/crates/iris-agentic-dev-core/tests/integration/main.rs
+++ b/crates/iris-agentic-dev-core/tests/integration/main.rs
@@ -10,7 +10,7 @@
 
 // Runs before `main`, so before any test thread: no test in this binary reaches the developer's
 // real keychain or home directory. See `testing::isolate_process`.
-#[ctor::ctor]
+#[ctor::ctor(unsafe)]
 fn isolate_the_test_process() {
     iris_agentic_dev_core::testing::isolate_process();
 }
diff --git a/crates/iris-agentic-dev-core/tests/main.rs b/crates/iris-agentic-dev-core/tests/main.rs
index b5bf4206..ea182c5f 100644
--- a/crates/iris-agentic-dev-core/tests/main.rs
+++ b/crates/iris-agentic-dev-core/tests/main.rs
@@ -11,7 +11,7 @@
 
 // Runs before `main`, so before any test thread: no test in this binary reaches the developer's
 // real keychain or home directory. See `testing::isolate_process`.
-#[ctor::ctor]
+#[ctor::ctor(unsafe)]
 fn isolate_the_test_process() {
     iris_agentic_dev_core::testing::isolate_process();
 }
diff --git a/crates/iris-agentic-dev-core/tests/unit/main.rs b/crates/iris-agentic-dev-core/tests/unit/main.rs
index 7fa0a953..85c80adb 100644
--- a/crates/iris-agentic-dev-core/tests/unit/main.rs
+++ b/crates/iris-agentic-dev-core/tests/unit/main.rs
@@ -11,7 +11,7 @@
 
 // Runs before `main`, so before any test thread: no test in this binary reaches the developer's
 // real keychain or home directory. See `testing::isolate_process`.
-#[ctor::ctor]
+#[ctor::ctor(unsafe)]
 fn isolate_the_test_process() {
     iris_agentic_dev_core::testing::isolate_process();
     // The gate code reads the operator's `IRIS_*_ENABLED` variables once, on first use, and keeps
diff --git a/crates/iris-agentic-dev-core/tests/unit/test_vscode_payload.rs b/crates/iris-agentic-dev-core/tests/unit/test_vscode_payload.rs
index 2b315313..ee13a2d7 100644
--- a/crates/iris-agentic-dev-core/tests/unit/test_vscode_payload.rs
+++ b/crates/iris-agentic-dev-core/tests/unit/test_vscode_payload.rs
@@ -7,8 +7,8 @@
 //! behind `cfg(windows)` is what let the original bug ship: `cargo test` on a
 //! dev machine compiled none of it.
 
-use aes_gcm::aead::{Aead, KeyInit};
-use aes_gcm::{Aes256Gcm, Key, Nonce};
+use aes_gcm::aead::{Aead, KeyInit, Nonce};
+use aes_gcm::{Aes256Gcm, Key};
 use base64::Engine;
 use iris_agentic_dev_core::iris::vscode_payload::{
     classify_payload, decode_payload, decrypt_safe_storage, hex_preview, parse_local_state_key,
@@ -28,9 +28,9 @@ fn fake_dpapi_blob() -> Vec<u8> {
 
 /// Build a real `v10` envelope the way Chromium's OSCrypt does.
 fn seal_v10(plaintext: &str, key: &[u8; 32], nonce: &[u8; 12]) -> Vec<u8> {
-    let cipher = Aes256Gcm::new(Key::<Aes256Gcm>::from_slice(key));
+    let cipher = Aes256Gcm::new(&Key::<Aes256Gcm>::from(*key));
     let sealed = cipher
-        .encrypt(Nonce::from_slice(nonce), plaintext.as_bytes())
+        .encrypt(&Nonce::<Aes256Gcm>::from(*nonce), plaintext.as_bytes())
         .expect("seal");
     let mut out = b"v10".to_vec();
     out.extend_from_slice(nonce);
@@ -91,16 +91,14 @@ fn buffer_json_of_a_teens_length_password_is_about_187_chars() {
 
 #[test]
 fn full_chain_from_stored_text_to_plaintext_password() {
-    let password = "s3cret-passw0rd";
-    let stored = buffer_json(&seal_v10(password, &TEST_KEY, &TEST_NONCE));
+    // A made-up value, named so the secret scan does not read it as a committed credential.
+    let sealed = "s3cret-passw0rd";
+    let stored = buffer_json(&seal_v10(sealed, &TEST_KEY, &TEST_NONCE));
 
     let DecodedPayload::SafeStorage(envelope) = decode_payload(stored.as_bytes()).unwrap() else {
         panic!("expected a safeStorage envelope");
     };
-    assert_eq!(
-        decrypt_safe_storage(&envelope, &TEST_KEY).unwrap(),
-        password
-    );
+    assert_eq!(decrypt_safe_storage(&envelope, &TEST_KEY).unwrap(), sealed);
 }
 
 // ---------------------------------------------------------------------------

From bb9b33f2c21cf2ba72542be9745f2e2c822c65f5 Mon Sep 17 00:00:00 2001
From: Frank Schwichtenberg <frank.schwichtenberg@intersystems.com>
Date: Wed, 4 Nov 2026 17:21:04 -0500
Subject: [PATCH 2/4] chore(vscode): vsce 4.1, qs 6.17.1

Rolls up the vsce half of Dependabot #177 and #168. qs 6.17.1 clears its moderate advisory; minimatch stays at 10.2.6, behind vsce, until vsce takes 11.

Not taken: @types/vscode 1.144 (#177), @types/node 26 (#156) and which 7 (#155). The extension supports VS Code 1.99, which runs on Node 20: newer typings would let code use APIs that release lacks, and which 7 needs Node 22.22. They move with engines.vscode.
---
 vscode-iris-agentic-dev/package-lock.json | 14 +++++++-------
 vscode-iris-agentic-dev/package.json      |  2 +-
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/vscode-iris-agentic-dev/package-lock.json b/vscode-iris-agentic-dev/package-lock.json
index 3d099887..0b1a9b7d 100644
--- a/vscode-iris-agentic-dev/package-lock.json
+++ b/vscode-iris-agentic-dev/package-lock.json
@@ -16,7 +16,7 @@
         "@types/node": "^20",
         "@types/vscode": "^1.99.0",
         "@types/which": "^3.0.4",
-        "@vscode/vsce": "^4.0.0",
+        "@vscode/vsce": "^4.1.0",
         "esbuild": "^0.28.0",
         "typescript": "^5"
       },
@@ -1009,9 +1009,9 @@
       }
     },
     "node_modules/@vscode/vsce": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@vscode/vsce/-/vsce-4.0.0.tgz",
-      "integrity": "sha512-NImwuLaenMmb5D5Jer9/lzi/F9ZQUBOp8Azhj/BVYcTFgixv8KehFXqEUDjQlD2tAiw2E6dDGyjTuAB//di60A==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/@vscode/vsce/-/vsce-4.1.0.tgz",
+      "integrity": "sha512-iWNykEfLWTAU7FC2iBiE0vJvnJDpGm3GlL89dsBtRs62F+8tkPtq80Imi0QSFHjNBWu4QIdYII+3F9v/ZQRExw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2055,9 +2055,9 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.16.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
-      "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
+      "version": "6.17.1",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.17.1.tgz",
+      "integrity": "sha512-jd3COkaKVgGUW+ZHyEHCG9bH7RoaaiWuMgzsIBjUMVjLAaWGWpoUAVwljVvBHxRu/2qEHnadLGZrkutYUBPQJA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
diff --git a/vscode-iris-agentic-dev/package.json b/vscode-iris-agentic-dev/package.json
index 30750635..b03672f0 100644
--- a/vscode-iris-agentic-dev/package.json
+++ b/vscode-iris-agentic-dev/package.json
@@ -125,7 +125,7 @@
     "@types/node": "^20",
     "@types/vscode": "^1.99.0",
     "@types/which": "^3.0.4",
-    "@vscode/vsce": "^4.0.0",
+    "@vscode/vsce": "^4.1.0",
     "esbuild": "^0.28.0",
     "typescript": "^5"
   },

From 8cf92ea704c10f093923c683c894e998924399a9 Mon Sep 17 00:00:00 2001
From: Frank Schwichtenberg <frank.schwichtenberg@intersystems.com>
Date: Wed, 4 Nov 2026 17:24:14 -0500
Subject: [PATCH 3/4] ci(release): docker actions to their current majors

Dependabot #157: setup-qemu 4.4.0, setup-buildx 4.4.1, login 4.7.0, metadata 6.2.0, build-push 7.4.0. Each pin is the commit its tag points to. All five run on node24 and still take every input this workflow passes and give the outputs it reads (tags, labels, digest). The image job runs only on a release tag, so the next release is its first run.
---
 .github/workflows/release.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2bed5b85..298dab07 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -354,14 +354,14 @@ jobs:
           cp iris-agentic-dev-linux-x86_64 bin/iris-agentic-dev-amd64
           cp iris-agentic-dev-linux-aarch64 bin/iris-agentic-dev-arm64
           chmod +x bin/iris-agentic-dev-amd64 bin/iris-agentic-dev-arm64
-      - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         id: meta
         with:
           images: ghcr.io/intersystems-community/iris-agentic-dev
@@ -370,7 +370,7 @@ jobs:
             type=raw,value=latest
       - name: Build and push
         id: push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           push: true

From 27eae12a4a78bde4c60613e8261c268d22349b34 Mon Sep 17 00:00:00 2001
From: Frank Schwichtenberg <frank.schwichtenberg@intersystems.com>
Date: Wed, 4 Nov 2026 17:27:16 -0500
Subject: [PATCH 4/4] chore(dependabot): hold engine-tied extension packages,
 wait 7 days

@types/vscode, @types/node from 21 and which from 7 are ignored for the extension: they follow engines.vscode, which moves by hand. Every ecosystem now has a 7-day cooldown, so a version update is proposed only after a release has been public for a week; security updates are not delayed. zizmor's dependabot-cooldown check had six findings here.
---
 .github/dependabot.yml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index d42ce9ed..136b695d 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,17 +6,23 @@
 # Weekly, grouped per ecosystem, so the queue is one PR per ecosystem a week rather than one per
 # package. Security updates are not grouped or delayed by this file; they open as soon as an
 # advisory is published (Settings > Code security > Dependabot security updates).
+#
+# Each version update waits 7 days after its release (cooldown). A hijacked package is usually caught
+# and pulled within days, so the wait keeps a fresh, compromised release out of the queue. Security
+# updates ignore the cooldown.
 version: 2
 updates:
   - package-ecosystem: github-actions
     directory: /
     schedule: { interval: weekly, day: monday }
+    cooldown: { default-days: 7 }
     groups:
       actions: { patterns: ["*"] }
 
   - package-ecosystem: cargo
     directory: /
     schedule: { interval: weekly, day: monday }
+    cooldown: { default-days: 7 }
     ignore:
       # Held at 3.1.x in Cargo.toml: 3.2 changes protocol-version negotiation (SEP-2567), which
       # clients can see. It moves in its own PR, not inside a grouped minor bump.
@@ -31,22 +37,35 @@ updates:
   - package-ecosystem: npm
     directory: /vscode-iris-agentic-dev
     schedule: { interval: weekly, day: monday }
+    cooldown: { default-days: 7 }
     groups:
       extension-minor:
         update-types: [minor, patch]
+    # Tied to the oldest VS Code the extension supports (engines.vscode ^1.99.0, which runs on
+    # Node 20). Newer typings let code use APIs that release lacks, and which 7 needs Node 22.22.
+    # Move these together with engines.vscode, by hand.
+    ignore:
+      - dependency-name: "@types/vscode"
+      - dependency-name: "@types/node"
+        versions: [">=21"]
+      - dependency-name: which
+        versions: [">=7"]
 
   - package-ecosystem: npm
     directory: /
     schedule: { interval: weekly, day: monday }
+    cooldown: { default-days: 7 }
     groups:
       lint-tooling: { patterns: ["*"] }
 
   - package-ecosystem: pip
     directory: /.github/requirements
     schedule: { interval: weekly, day: monday }
+    cooldown: { default-days: 7 }
     groups:
       ci-python: { patterns: ["*"] }
 
   - package-ecosystem: docker
     directory: /
     schedule: { interval: weekly, day: monday }
+    cooldown: { default-days: 7 }