From ce3cb6d57edeb4568772918f1c7e0a5d9895a125 Mon Sep 17 00:00:00 2001
From: Aram Grigoryan <132480+aram356@users.noreply.github.com>
Date: Sun, 6 Sep 2026 13:30:00 -0700
Subject: [PATCH 01/11] Upgrade to Rust 1.98.1 and align dependencies with
 EdgeZero

Match the toolchain and shared dependency pins to EdgeZero PR #366 so
both workspaces resolve the same major versions.

Toolchain: Rust 1.95.0 to 1.98.1, Node 24.12.0 to 24.20.0, Fastly CLI
15.1.0 to 16.0.0, Viceroy 0.17.0 to 0.21.0, wasmtime 44.0.1 to 48.0.1.
CI derives each from `.tool-versions`, so only that file and
`rust-toolchain.toml` pin them.

EdgeZero moves from tag v0.0.7 to the PR #366 head revision. The latest
tag, v0.0.8, still carries the 1.95 toolchain and the previous majors,
so it would contradict the pins below. Restore a tag once #366 merges.

Shared majors: fastly and log-fastly 0.12 to 0.13, spin-sdk ~6.0 to
~7.0, validator 0.20 to 0.21, sha2 0.10 to 0.11. brotli stays at 8 for
the reason recorded in #366: async-compression still resolves 8, so
taking 9 adds a second decompressor stack rather than replacing one.

sha2 0.11 moves RustCrypto to `hybrid_array`, which forces two further
majors this workspace needs but #366 did not: hmac 0.12 to 0.13 and
chacha20poly1305 0.10 to 0.11. Their fallout is three lines:

- `new_from_slice` moved from `Mac` to `KeyInit`, so `ec/generation.rs`
  and `s3_sigv4.rs` bring that trait into scope. HMAC output is
  unchanged, verified byte-for-byte against 0.12 for both a short key
  and a block-length key, so persisted EC IDs and SigV4 signatures stay
  valid.
- `Array` does not implement `LowerHex` as `GenericArray` did, so
  `settings_data.rs` formats via `hex::encode`.

sha2 0.11 also pulls crypto-common 0.2, which depends on getrandom 0.4.
That line renamed the browser RNG feature from `js` to `wasm_js`, so
the Cloudflare target needs a second getrandom entry to enable it.

The Fastly adapter does not build on this branch: `esi` 0.7.2 pins
fastly ^0.12 while EdgeZero requires 0.13, and both meet in
`esi_assembly.rs`. Upstream `fastly/esi` main is still on ^0.12.
---
 .tool-versions                                |  10 +-
 CLAUDE.md                                     |  14 +-
 Cargo.lock                                    | 342 ++++++++++++------
 Cargo.toml                                    |  36 +-
 crates/trusted-server-core/Cargo.toml         |   1 +
 .../trusted-server-core/src/ec/generation.rs  |   2 +-
 crates/trusted-server-core/src/s3_sigv4.rs    |   2 +-
 .../trusted-server-core/src/settings_data.rs  |   2 +-
 rust-toolchain.toml                           |   2 +-
 9 files changed, 270 insertions(+), 141 deletions(-)

diff --git a/.tool-versions b/.tool-versions
index 7581468008..1f933d9f60 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1,5 +1,5 @@
-fastly 15.1.0
-rust 1.95.0
-nodejs 24.12.0
-viceroy 0.17.0
-wasmtime 44.0.1
+fastly 16.0.0
+rust 1.98.1
+nodejs 24.20.0
+viceroy 0.21.0
+wasmtime 48.0.1
diff --git a/CLAUDE.md b/CLAUDE.md
index 546a3bf526..2f8583f697 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -32,12 +32,12 @@ Supporting files: `edgezero.toml`, `fastly.toml`,
 
 | Tool        | Version / Target                         |
 | ----------- | ---------------------------------------- |
-| Rust        | 1.95.0 (pinned in `rust-toolchain.toml`) |
+| Rust        | 1.98.1 (pinned in `rust-toolchain.toml`) |
 | WASM target | `wasm32-wasip1`                          |
-| Node        | 24.12.0 (from `.tool-versions`)          |
-| Fastly CLI  | 15.1.0 (from `.tool-versions`)           |
-| Viceroy     | 0.17.0 (from `.tool-versions`)           |
-| Wasmtime    | 44.0.1 (from `.tool-versions`)           |
+| Node        | 24.20.0 (from `.tool-versions`)          |
+| Fastly CLI  | 16.0.0 (from `.tool-versions`)           |
+| Viceroy     | 0.21.0 (from `.tool-versions`)           |
+| Wasmtime    | 48.0.1 (from `.tool-versions`)           |
 
 ---
 
@@ -139,7 +139,7 @@ cd crates/trusted-server-js/lib && node build-all.mjs
 ### Install prerequisites
 
 ```bash
-cargo install viceroy --version 0.17.0 --locked --force
+cargo install viceroy --version 0.21.0 --locked --force
 ```
 
 ---
@@ -326,7 +326,7 @@ IntegrationRegistration::builder(ID)
 | `fastly.toml`                   | Fastly service configuration and build settings                 |
 | `trusted-server.example.toml`   | Source-controlled Trusted Server app-config template            |
 | `trusted-server.toml`           | Operator-owned app config; gitignored; `ts config push` publishes it as an EdgeZero blob envelope |
-| `rust-toolchain.toml`           | Pins Rust version to 1.95.0                                     |
+| `rust-toolchain.toml`           | Pins Rust version to 1.98.1                                     |
 | `.env.dev`                      | Local development environment variables                         |
 
 ---
diff --git a/Cargo.lock b/Cargo.lock
index 8da486f8c9..c77f86d22d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -10,24 +10,12 @@ checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
 [[package]]
 name = "aead"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
-dependencies = [
- "crypto-common",
- "generic-array",
-]
-
-[[package]]
-name = "ahash"
-version = "0.8.12"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+checksum = "1973cfbc1a2daf9cf550e74e1f088c28e7f7d8c1e1418fb6c9dc5184b7e84c99"
 dependencies = [
- "cfg-if",
- "once_cell",
- "version_check",
- "zerocopy",
+ "crypto-common 0.2.2",
+ "inout",
 ]
 
 [[package]]
@@ -356,6 +344,12 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
 
+[[package]]
+name = "base16ct"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd307490d624467aa6f74b0eabb77633d1f758a7b25f12bceb0b22e08d9726f6"
+
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -410,6 +404,15 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "block-buffer"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "bollard"
 version = "0.19.4"
@@ -517,6 +520,16 @@ dependencies = [
  "tinyvec",
 ]
 
+[[package]]
+name = "bstr"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bb31b46c14244e20ee9984b11bf5c992b91fb6939fea616e3512c8baecdbe5f"
+dependencies = [
+ "memchr",
+ "serde_core",
+]
+
 [[package]]
 name = "build-print"
 version = "1.0.1"
@@ -574,17 +587,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
-[[package]]
-name = "chacha20"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
-dependencies = [
- "cfg-if",
- "cipher",
- "cpufeatures 0.2.17",
-]
-
 [[package]]
 name = "chacha20"
 version = "0.10.1"
@@ -592,21 +594,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
 dependencies = [
  "cfg-if",
+ "cipher",
  "cpufeatures 0.3.0",
  "rand_core 0.10.1",
 ]
 
 [[package]]
 name = "chacha20poly1305"
-version = "0.10.1"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
+checksum = "9b89e1c441e926b9c82a8d023f6e1b7ae0adcfaa7d621814e4d60789bac751cb"
 dependencies = [
  "aead",
- "chacha20 0.9.1",
+ "chacha20",
  "cipher",
  "poly1305",
- "zeroize",
 ]
 
 [[package]]
@@ -717,13 +719,13 @@ dependencies = [
 
 [[package]]
 name = "cipher"
-version = "0.4.4"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
 dependencies = [
- "crypto-common",
+ "block-buffer 0.12.1",
+ "crypto-common 0.2.2",
  "inout",
- "zeroize",
 ]
 
 [[package]]
@@ -775,6 +777,12 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+
 [[package]]
 name = "colorchoice"
 version = "1.0.5"
@@ -844,6 +852,12 @@ version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
 [[package]]
 name = "const-random"
 version = "0.1.18"
@@ -1013,10 +1027,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
  "generic-array",
- "rand_core 0.6.4",
  "typenum",
 ]
 
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "getrandom 0.4.3",
+ "hybrid-array",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "cssparser"
 version = "0.35.0"
@@ -1063,6 +1087,15 @@ dependencies = [
  "linktime-proc-macro",
 ]
 
+[[package]]
+name = "ctutils"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+dependencies = [
+ "cmov",
+]
+
 [[package]]
 name = "curve25519-dalek"
 version = "4.1.3"
@@ -1203,7 +1236,7 @@ version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
- "const-oid",
+ "const-oid 0.9.6",
  "zeroize",
 ]
 
@@ -1300,9 +1333,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer 0.10.4",
- "const-oid",
- "crypto-common",
- "subtle",
+ "const-oid 0.9.6",
+ "crypto-common 0.1.7",
+]
+
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "block-buffer 0.12.1",
+ "const-oid 0.10.2",
+ "crypto-common 0.2.2",
+ "ctutils",
 ]
 
 [[package]]
@@ -1427,7 +1471,7 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.7#5c9886e51d17e6969531356bacdf27f144ac8a2e"
+source = "git+https://github.com/stackpop/edgezero?rev=40c52e3f68aeef925d395688d34d601fc269ee4f#40c52e3f68aeef925d395688d34d601fc269ee4f"
 dependencies = [
  "toml",
 ]
@@ -1435,7 +1479,7 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter-axum"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.7#5c9886e51d17e6969531356bacdf27f144ac8a2e"
+source = "git+https://github.com/stackpop/edgezero?rev=40c52e3f68aeef925d395688d34d601fc269ee4f#40c52e3f68aeef925d395688d34d601fc269ee4f"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1463,7 +1507,7 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter-cloudflare"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.7#5c9886e51d17e6969531356bacdf27f144ac8a2e"
+source = "git+https://github.com/stackpop/edgezero?rev=40c52e3f68aeef925d395688d34d601fc269ee4f#40c52e3f68aeef925d395688d34d601fc269ee4f"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1486,18 +1530,19 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter-fastly"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.7#5c9886e51d17e6969531356bacdf27f144ac8a2e"
+source = "git+https://github.com/stackpop/edgezero?rev=40c52e3f68aeef925d395688d34d601fc269ee4f#40c52e3f68aeef925d395688d34d601fc269ee4f"
 dependencies = [
  "anyhow",
  "async-stream",
  "async-trait",
+ "base16ct 1.0.0",
  "brotli",
  "bytes",
  "chrono",
  "ctor",
  "edgezero-adapter",
  "edgezero-core",
- "fastly",
+ "fastly 0.13.1",
  "fern",
  "flate2",
  "futures",
@@ -1506,7 +1551,7 @@ dependencies = [
  "log-fastly",
  "serde",
  "serde_json",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "thiserror 2.0.18",
  "toml_edit 0.25.12+spec-1.1.0",
  "walkdir",
@@ -1515,7 +1560,7 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter-spin"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.7#5c9886e51d17e6969531356bacdf27f144ac8a2e"
+source = "git+https://github.com/stackpop/edgezero?rev=40c52e3f68aeef925d395688d34d601fc269ee4f#40c52e3f68aeef925d395688d34d601fc269ee4f"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1542,7 +1587,7 @@ dependencies = [
 [[package]]
 name = "edgezero-cli"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.7#5c9886e51d17e6969531356bacdf27f144ac8a2e"
+source = "git+https://github.com/stackpop/edgezero?rev=40c52e3f68aeef925d395688d34d601fc269ee4f#40c52e3f68aeef925d395688d34d601fc269ee4f"
 dependencies = [
  "chrono",
  "clap",
@@ -1567,12 +1612,13 @@ dependencies = [
 [[package]]
 name = "edgezero-core"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.7#5c9886e51d17e6969531356bacdf27f144ac8a2e"
+source = "git+https://github.com/stackpop/edgezero?rev=40c52e3f68aeef925d395688d34d601fc269ee4f#40c52e3f68aeef925d395688d34d601fc269ee4f"
 dependencies = [
  "anyhow",
  "async-compression",
  "async-stream",
  "async-trait",
+ "base16ct 1.0.0",
  "bytes",
  "edgezero-macros",
  "futures",
@@ -1586,7 +1632,7 @@ dependencies = [
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "thiserror 2.0.18",
  "toml",
  "tower-service",
@@ -1598,7 +1644,7 @@ dependencies = [
 [[package]]
 name = "edgezero-macros"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.7#5c9886e51d17e6969531356bacdf27f144ac8a2e"
+source = "git+https://github.com/stackpop/edgezero?rev=40c52e3f68aeef925d395688d34d601fc269ee4f#40c52e3f68aeef925d395688d34d601fc269ee4f"
 dependencies = [
  "log",
  "proc-macro2",
@@ -1628,7 +1674,7 @@ version = "0.13.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
 dependencies = [
- "base16ct",
+ "base16ct 0.2.0",
  "crypto-bigint",
  "digest 0.10.7",
  "ff",
@@ -1729,7 +1775,7 @@ dependencies = [
  "base64",
  "bytes",
  "chrono",
- "fastly",
+ "fastly 0.12.1",
  "html-escape",
  "log",
  "md5",
@@ -1773,9 +1819,9 @@ dependencies = [
  "bytes",
  "downcast-rs",
  "elsa",
- "fastly-macros",
- "fastly-shared",
- "fastly-sys",
+ "fastly-macros 0.12.1",
+ "fastly-shared 0.12.1",
+ "fastly-sys 0.12.1",
  "http",
  "itertools 0.13.0",
  "lazy_static",
@@ -1791,6 +1837,33 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "fastly"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c5c07c0c67d0b5826d1cb2311e563a17860b50e2ae89e1c703d6400d904d1e2"
+dependencies = [
+ "anyhow",
+ "bytes",
+ "downcast-rs",
+ "elsa",
+ "fastly-macros 0.13.1",
+ "fastly-shared 0.13.1",
+ "fastly-sys 0.13.1",
+ "http",
+ "itertools 0.13.0",
+ "mime",
+ "serde",
+ "serde_json",
+ "serde_repr",
+ "serde_urlencoded",
+ "sha2 0.9.9",
+ "smallvec",
+ "thiserror 1.0.69",
+ "time",
+ "url",
+]
+
 [[package]]
 name = "fastly-macros"
 version = "0.12.1"
@@ -1802,6 +1875,17 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "fastly-macros"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "698025eab5612adab20df48963a5126650893014e8505af02a0af20939ee6a05"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "fastly-shared"
 version = "0.12.1"
@@ -1812,6 +1896,16 @@ dependencies = [
  "http",
 ]
 
+[[package]]
+name = "fastly-shared"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "191c2cf082f5d17f4ca0685cedaa0642ad4ade949fac8d1dbdd62ff756b13500"
+dependencies = [
+ "bitflags 1.3.2",
+ "http",
+]
+
 [[package]]
 name = "fastly-sys"
 version = "0.12.1"
@@ -1819,7 +1913,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "de75ef193f6c29c43d667458bede648970715aedd5db2d42c2eba3ffa3ad738b"
 dependencies = [
  "bitflags 1.3.2",
- "fastly-shared",
+ "fastly-shared 0.12.1",
+ "http",
+ "wasip2",
+ "wit-bindgen 0.51.0",
+]
+
+[[package]]
+name = "fastly-sys"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "239c77706cf9110b423a89b6b03b8011729b144390d2a7f641d95ef66b2768b8"
+dependencies = [
+ "bitflags 1.3.2",
+ "fastly-shared 0.13.1",
  "http",
  "wasip2",
  "wit-bindgen 0.51.0",
@@ -2082,9 +2189,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "r-efi 6.0.0",
  "rand_core 0.10.1",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -2161,9 +2270,6 @@ name = "hashbrown"
 version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
-dependencies = [
- "ahash",
-]
 
 [[package]]
 name = "hashbrown"
@@ -2185,15 +2291,6 @@ dependencies = [
  "foldhash",
 ]
 
-[[package]]
-name = "hashlink"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ba4ff7128dee98c7dc9794b6a411377e1404dba1c97deb8d1a55297bd25d8af"
-dependencies = [
- "hashbrown 0.14.5",
-]
-
 [[package]]
 name = "hashlink"
 version = "0.11.1"
@@ -2223,11 +2320,11 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "hmac"
-version = "0.12.1"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
 dependencies = [
- "digest 0.10.7",
+ "digest 0.11.3",
 ]
 
 [[package]]
@@ -2301,6 +2398,15 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
+[[package]]
+name = "hybrid-array"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
+dependencies = [
+ "typenum",
+]
+
 [[package]]
 name = "hyper"
 version = "1.10.1"
@@ -2601,11 +2707,11 @@ dependencies = [
 
 [[package]]
 name = "inout"
-version = "0.1.4"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
 dependencies = [
- "generic-array",
+ "hybrid-array",
 ]
 
 [[package]]
@@ -2835,9 +2941,9 @@ dependencies = [
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.30.1"
+version = "0.38.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
+checksum = "f1d20bef17f513b9b3004532233187769cd072d790971f4e4da0e346eb6401e8"
 dependencies = [
  "cc",
  "pkg-config",
@@ -2891,11 +2997,11 @@ checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 
 [[package]]
 name = "log-fastly"
-version = "0.12.1"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51dae5def13a2d557fdb63862d642f8d4641ec3773c036bb14092697b6764013"
+checksum = "433713b6191ad3e1d5248db9536f3e2d99a12d7ff998afd272a98d96e6dbc2ed"
 dependencies = [
- "fastly",
+ "fastly 0.13.1",
  "log",
  "regex",
 ]
@@ -3545,12 +3651,11 @@ checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
 
 [[package]]
 name = "poly1305"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
+checksum = "6e2d0073b297041425c7c3df6eb4792d598a15323fe63346852b092eca02904c"
 dependencies = [
- "cpufeatures 0.2.17",
- "opaque-debug",
+ "cpufeatures 0.3.0",
  "universal-hash",
 ]
 
@@ -3853,7 +3958,7 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
- "chacha20 0.10.1",
+ "chacha20",
  "getrandom 0.4.3",
  "rand_core 0.10.1",
 ]
@@ -3918,9 +4023,9 @@ dependencies = [
 
 [[package]]
 name = "redb"
-version = "4.1.0"
+version = "4.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e925444704b5f17d32bf42f5b6e2df050bceebc3dcd6e71cc73dafe8092e839"
+checksum = "de6c3b63e007e90ce536ec2ae4690826136a20ec8dbbbb400daef1bb999d2e36"
 dependencies = [
  "libc",
 ]
@@ -4109,7 +4214,7 @@ version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
 dependencies = [
- "const-oid",
+ "const-oid 0.9.6",
  "digest 0.10.7",
  "num-bigint-dig",
  "num-integer",
@@ -4125,14 +4230,13 @@ dependencies = [
 
 [[package]]
 name = "rusqlite"
-version = "0.32.1"
+version = "0.40.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7753b721174eb8ff87a9a0e799e2d7bc3749323e773db92e0984debb00019d6e"
+checksum = "23f2a97da3e3873c73cb2a2e71b35c40ff95e0b1eefa8d72d8499a6928c3b5b3"
 dependencies = [
  "bitflags 2.13.0",
  "fallible-iterator",
  "fallible-streaming-iterator",
- "hashlink 0.9.1",
  "libsqlite3-sys",
  "smallvec",
 ]
@@ -4351,7 +4455,7 @@ version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
 dependencies = [
- "base16ct",
+ "base16ct 0.2.0",
  "der",
  "generic-array",
  "subtle",
@@ -4611,6 +4715,17 @@ dependencies = [
  "digest 0.10.7",
 ]
 
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
+]
+
 [[package]]
 name = "shlex"
 version = "2.0.1"
@@ -4661,9 +4776,12 @@ checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
 
 [[package]]
 name = "similar"
-version = "2.7.0"
+version = "3.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbbb5d9659141646ae647b42fe094daf6c6192d1620870b449d9557f748b2daa"
+checksum = "4f66ca1f7aca2474dc10c942eb22feffc897735f54cd1db90138c2fddb490987"
+dependencies = [
+ "bstr",
+]
 
 [[package]]
 name = "simple_logger"
@@ -4713,9 +4831,9 @@ checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
 
 [[package]]
 name = "spin-macro"
-version = "6.0.0"
+version = "7.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11e483b94d5bcfac493caf0427fa875063e3e8604d0466a4ab491ec200a42857"
+checksum = "ac8a641da857d4e7cada31a853c40180eeb10485a0f2f0282d0a7e5a2a4105d4"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4724,9 +4842,9 @@ dependencies = [
 
 [[package]]
 name = "spin-sdk"
-version = "6.0.0"
+version = "7.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fd2abac3eb2ee249c2241ab87f7b1287f36172c8cc1ea815c19c85e41ede44d"
+checksum = "2b7a3d9a6805ccdb4d404e91ccf7198ac5e486b6199dc9387aeebaa368272112"
 dependencies = [
  "anyhow",
  "bytes",
@@ -5391,14 +5509,14 @@ dependencies = [
  "edgezero-core",
  "error-stack",
  "esi",
- "fastly",
+ "fastly 0.13.1",
  "fern",
  "futures",
  "log",
  "log-fastly",
  "serde",
  "serde_json",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "trusted-server-core",
  "url",
  "urlencoding",
@@ -5485,6 +5603,7 @@ dependencies = [
  "flate2",
  "futures",
  "getrandom 0.2.17",
+ "getrandom 0.4.3",
  "glob",
  "hex",
  "hmac",
@@ -5500,7 +5619,7 @@ dependencies = [
  "regex",
  "serde",
  "serde_json",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "subtle",
  "temp-env",
  "tokio",
@@ -5549,7 +5668,7 @@ version = "0.1.0"
 dependencies = [
  "build-print",
  "hex",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "which",
 ]
 
@@ -5646,12 +5765,12 @@ checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
 
 [[package]]
 name = "universal-hash"
-version = "0.5.1"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+checksum = "f4987bdc12753382e0bec4a65c50738ffaabc998b9cdd1f952fb5f39b0048a96"
 dependencies = [
- "crypto-common",
- "subtle",
+ "crypto-common 0.2.2",
+ "ctutils",
 ]
 
 [[package]]
@@ -5743,12 +5862,11 @@ dependencies = [
 
 [[package]]
 name = "validator"
-version = "0.20.0"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43fb22e1a008ece370ce08a3e9e4447a910e92621bb49b85d6e48a45397e7cfa"
+checksum = "c3d68c6633c483df6780cc5277a417c7c2d1bceee2649d06c8ab6b0fd2dd3c81"
 dependencies = [
  "idna",
- "once_cell",
  "regex",
  "serde",
  "serde_derive",
@@ -5819,9 +5937,9 @@ dependencies = [
 
 [[package]]
 name = "wasip3"
-version = "0.6.0+wasi-0.3.0-rc-2026-03-15"
+version = "0.7.1+wasi-0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed83456dd6a0b8581998c0365e4651fa2997e5093b49243b7f35391afaa7a3d9"
+checksum = "75e9ed91ee5a995b6fe16c89d4511a8c12eb76967be20b57557618e02e781bcc"
 dependencies = [
  "bytes",
  "http",
@@ -6468,7 +6586,7 @@ checksum = "631a50d867fafb7093e709d75aaee9e0e0d5deb934021fcea25ac2fe09edc51e"
 dependencies = [
  "arraydeque",
  "encoding_rs",
- "hashlink 0.11.1",
+ "hashlink",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 7faba75535..6db2c0b747 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -44,7 +44,7 @@ base64 = "0.22"
 brotli = "8.0"
 build-print = "1.0.1"
 bytes = "1.11"
-chacha20poly1305 = "0.10"
+chacha20poly1305 = "0.11"
 chrono = "0.4.44"
 chromiumoxide = "0.9.1"
 clap = { version = "4", features = ["derive"] }
@@ -54,23 +54,33 @@ criterion = { version = "0.5", default-features = false, features = ["cargo_benc
 derive_more = { version = "2.0", features = ["display", "error"] }
 directories = "5"
 ed25519-dalek = { version = "2.2", features = ["rand_core"] }
-edgezero-adapter-axum = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.7", default-features = false }
-edgezero-adapter-cloudflare = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.7", default-features = false }
-edgezero-adapter-fastly = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.7", default-features = false }
-edgezero-adapter-spin = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.7", default-features = false }
-edgezero-cli = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.7" }
-edgezero-core = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.7", default-features = false }
+# Pinned to the head of edgezero PR #366 (Rust 1.98.1, fastly 0.13,
+# spin-sdk ~7, validator 0.21, sha2 0.11) rather than a tag: the latest
+# release, v0.0.8, still carries the 1.95 toolchain and the old majors,
+# so the shared pins below would fight it. Move back to a tag once #366
+# merges and is tagged.
+edgezero-adapter-axum = { git = "https://github.com/stackpop/edgezero", rev = "40c52e3f68aeef925d395688d34d601fc269ee4f", default-features = false }
+edgezero-adapter-cloudflare = { git = "https://github.com/stackpop/edgezero", rev = "40c52e3f68aeef925d395688d34d601fc269ee4f", default-features = false }
+edgezero-adapter-fastly = { git = "https://github.com/stackpop/edgezero", rev = "40c52e3f68aeef925d395688d34d601fc269ee4f", default-features = false }
+edgezero-adapter-spin = { git = "https://github.com/stackpop/edgezero", rev = "40c52e3f68aeef925d395688d34d601fc269ee4f", default-features = false }
+edgezero-cli = { git = "https://github.com/stackpop/edgezero", rev = "40c52e3f68aeef925d395688d34d601fc269ee4f" }
+edgezero-core = { git = "https://github.com/stackpop/edgezero", rev = "40c52e3f68aeef925d395688d34d601fc269ee4f", default-features = false }
 env_logger = "0.11"
 error-stack = "0.6"
 esi = "0.7.2"
-fastly = "0.12"
+fastly = "0.13"
 fern = "0.7.1"
 flate2 = "1.1"
 futures = "0.3"
 glob = "0.3"
 getrandom = "0.2"
+# `sha2` 0.11 pulls `crypto-common` 0.2, which depends on getrandom 0.4.
+# Both lines coexist in the graph; 0.4 renamed the browser RNG feature
+# from `js` to `wasm_js`, so it needs its own pin to enable it on
+# `wasm32-unknown-unknown`.
+getrandom_04 = { package = "getrandom", version = "0.4" }
 hex = "0.4.3"
-hmac = "0.12.1"
+hmac = "0.13"
 http = "1.4.0"
 httpdate = "1.0.3"
 http-body-util = "0.1"
@@ -81,7 +91,7 @@ jose-jwk = "0.1.2"
 js-sys = "0.3"
 libc = "0.2"
 log = "0.4.29"
-log-fastly = "0.12"
+log-fastly = "0.13"
 lol_html = "2.7.2"
 matchit = "0.9"
 mime = "0.3"
@@ -95,9 +105,9 @@ rustls-pemfile = "2"
 scraper = "0.24.0"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0.149"
-sha2 = "0.10.9"
+sha2 = "0.11"
 simple_logger = "5"
-spin-sdk = { version = "~6.0", default-features = false, features = ["http", "key-value", "variables"] }
+spin-sdk = { version = "~7.0", default-features = false, features = ["http", "key-value", "variables"] }
 subtle = "2.6"
 temp-env = "0.3.6"
 tempfile = "3.24"
@@ -114,7 +124,7 @@ trusted-server-openrtb = { path = "crates/trusted-server-openrtb" }
 url = "2.5.8"
 urlencoding = "2.1"
 uuid = { version = "1.18", features = ["v4"] }
-validator = { version = "0.20", features = ["derive"] }
+validator = { version = "0.21", features = ["derive"] }
 web-time = "1"
 webpki-roots = "1"
 which = "8"
diff --git a/crates/trusted-server-core/Cargo.toml b/crates/trusted-server-core/Cargo.toml
index e44d46f772..ce63642266 100644
--- a/crates/trusted-server-core/Cargo.toml
+++ b/crates/trusted-server-core/Cargo.toml
@@ -56,6 +56,7 @@ web-time = { workspace = true }
 # The Fastly adapter uses `wasm32-wasip1`, which has native POSIX RNG and does not
 # need these — this block is intentionally scoped to `target_os = "unknown"` only.
 getrandom = { workspace = true, features = ["js"] }
+getrandom_04 = { workspace = true, features = ["wasm_js"] }
 uuid = { workspace = true, features = ["js"] }
 
 [features]
diff --git a/crates/trusted-server-core/src/ec/generation.rs b/crates/trusted-server-core/src/ec/generation.rs
index 2924b76925..6b9ed27166 100644
--- a/crates/trusted-server-core/src/ec/generation.rs
+++ b/crates/trusted-server-core/src/ec/generation.rs
@@ -6,7 +6,7 @@
 use std::net::IpAddr;
 
 use error_stack::{Report, ResultExt};
-use hmac::{Hmac, Mac};
+use hmac::{Hmac, KeyInit as _, Mac};
 use rand::Rng;
 use sha2::Sha256;
 
diff --git a/crates/trusted-server-core/src/s3_sigv4.rs b/crates/trusted-server-core/src/s3_sigv4.rs
index 1a862882ed..dc4dc25ad2 100644
--- a/crates/trusted-server-core/src/s3_sigv4.rs
+++ b/crates/trusted-server-core/src/s3_sigv4.rs
@@ -14,7 +14,7 @@ use std::time::SystemTime;
 
 use chrono::{DateTime, Utc};
 use error_stack::Report;
-use hmac::{Hmac, Mac as _};
+use hmac::{Hmac, KeyInit as _, Mac as _};
 use http::{HeaderMap, HeaderValue, Method, header};
 use sha2::{Digest as _, Sha256};
 use url::Url;
diff --git a/crates/trusted-server-core/src/settings_data.rs b/crates/trusted-server-core/src/settings_data.rs
index e9caa08d27..346c697bc5 100644
--- a/crates/trusted-server-core/src/settings_data.rs
+++ b/crates/trusted-server-core/src/settings_data.rs
@@ -178,7 +178,7 @@ fn resolve_fastly_chunk_pointer(
 }
 
 fn sha256_hex(bytes: &[u8]) -> String {
-    format!("{:x}", Sha256::digest(bytes))
+    hex::encode(Sha256::digest(bytes))
 }
 
 fn configuration_error<T>(message: String) -> Result<T, Report<TrustedServerError>> {
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index e72500aa19..b21f5b55e9 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,3 +1,3 @@
 [toolchain]
-channel = "1.95.0"
+channel = "1.98.1"
 targets = [ "wasm32-wasip1", "wasm32-unknown-unknown" ]

From 044374d206103f3696217c222d7660eae0547b6b Mon Sep 17 00:00:00 2001
From: Aram Grigoryan <132480+aram356@users.noreply.github.com>
Date: Sun, 6 Sep 2026 14:22:30 -0700
Subject: [PATCH 02/11] Update documentation for the 1.98.1 toolchain

Point the Viceroy install command at 0.21.0 in the getting-started,
testing and error-reference guides, the integration-tests README, and
the three scripts that name it in their prerequisites.

Fill in the Rust and NodeJS versions in the getting-started
prerequisites. Both were `{{RUST_VERSION}}` / `{{NODEJS_VERSION}}`
placeholders with no substitution step anywhere in the repo, so the
published page rendered the braces literally.

`docs/superpowers/**` keeps its 1.95 and 0.17.0 mentions: those are
dated design records describing the stack as it stood when each was
written.
---
 crates/trusted-server-integration-tests/README.md | 2 +-
 docs/guide/error-reference.md                     | 2 +-
 docs/guide/getting-started.md                     | 6 +++---
 docs/guide/testing.md                             | 2 +-
 scripts/integration-tests-browser.sh              | 2 +-
 scripts/integration-tests.sh                      | 2 +-
 scripts/template-cache-local-test.sh              | 2 +-
 7 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/crates/trusted-server-integration-tests/README.md b/crates/trusted-server-integration-tests/README.md
index e82cb88375..4edc569f55 100644
--- a/crates/trusted-server-integration-tests/README.md
+++ b/crates/trusted-server-integration-tests/README.md
@@ -7,7 +7,7 @@ containers using [Testcontainers](https://testcontainers.com/) and
 ## Prerequisites
 
 - **Docker** — running and accessible
-- **Viceroy** — Fastly local simulator (`cargo install viceroy --version 0.17.0 --locked --force`)
+- **Viceroy** — Fastly local simulator (`cargo install viceroy --version 0.21.0 --locked --force`)
 - **wasm32-wasip1 target** — `rustup target add wasm32-wasip1`
 - **Node.js** — version pinned in `.tool-versions`, for browser tests only
 
diff --git a/docs/guide/error-reference.md b/docs/guide/error-reference.md
index b5348ed9f3..0df5443eda 100644
--- a/docs/guide/error-reference.md
+++ b/docs/guide/error-reference.md
@@ -621,7 +621,7 @@ Warning: viceroy version mismatch
 **Solution:**
 
 ```bash
-cargo install viceroy --version 0.17.0 --locked --force
+cargo install viceroy --version 0.21.0 --locked --force
 ```
 
 ---
diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
index 459bcff4b2..d6cbc916f7 100644
--- a/docs/guide/getting-started.md
+++ b/docs/guide/getting-started.md
@@ -6,8 +6,8 @@ Get up and running with Trusted Server quickly.
 
 Before you begin, ensure you have the following installed (versions are pinned in `.tool-versions`):
 
-- Rust {{RUST_VERSION}} (see `.tool-versions`)
-- NodeJS {{NODEJS_VERSION}}
+- Rust 1.98.1 (see `.tool-versions`)
+- NodeJS 24.20.0
 - Basic familiarity with Rust and WebAssembly
 
 **For Fastly deployment** (optional for local dev):
@@ -50,7 +50,7 @@ Simulates the full Fastly production environment locally.
 Install and configure the Fastly CLI using the [Fastly setup guide](/guide/fastly), then install Viceroy:
 
 ```bash
-cargo install viceroy --version 0.17.0 --locked --force
+cargo install viceroy --version 0.21.0 --locked --force
 ```
 
 Start the local Fastly simulator:
diff --git a/docs/guide/testing.md b/docs/guide/testing.md
index e1751bc496..2bb0388150 100644
--- a/docs/guide/testing.md
+++ b/docs/guide/testing.md
@@ -10,7 +10,7 @@ Viceroy is the local test runtime for Fastly Compute applications. It simulates
 
 ```bash
 # Install viceroy
-cargo install viceroy --version 0.17.0 --locked --force
+cargo install viceroy --version 0.21.0 --locked --force
 
 # Run Fastly/WASM crate tests (viceroy is invoked automatically via .cargo/config.toml runner)
 cargo test-fastly
diff --git a/scripts/integration-tests-browser.sh b/scripts/integration-tests-browser.sh
index 714de510bc..b8995b16a0 100755
--- a/scripts/integration-tests-browser.sh
+++ b/scripts/integration-tests-browser.sh
@@ -7,7 +7,7 @@
 #
 # Prerequisites:
 #   - Docker running
-#   - Viceroy installed: cargo install viceroy --version 0.17.0 --locked --force
+#   - Viceroy installed: cargo install viceroy --version 0.21.0 --locked --force
 #   - wasm32-wasip1 target: rustup target add wasm32-wasip1
 #   - Node.js with npx available
 #
diff --git a/scripts/integration-tests.sh b/scripts/integration-tests.sh
index 96e492f40a..2071559967 100755
--- a/scripts/integration-tests.sh
+++ b/scripts/integration-tests.sh
@@ -7,7 +7,7 @@
 #
 # Prerequisites:
 #   - Docker running
-#   - Viceroy installed: cargo install viceroy --version 0.17.0 --locked --force
+#   - Viceroy installed: cargo install viceroy --version 0.21.0 --locked --force
 #   - wasm32-wasip1 target: rustup target add wasm32-wasip1
 #
 set -euo pipefail
diff --git a/scripts/template-cache-local-test.sh b/scripts/template-cache-local-test.sh
index ad9939d0a6..9867aecdd5 100755
--- a/scripts/template-cache-local-test.sh
+++ b/scripts/template-cache-local-test.sh
@@ -53,7 +53,7 @@ cleanup() {
 trap cleanup EXIT INT TERM
 
 command -v viceroy >/dev/null || {
-  echo "viceroy not found. Install: cargo install viceroy --version 0.17.0 --locked" >&2
+  echo "viceroy not found. Install: cargo install viceroy --version 0.21.0 --locked" >&2
   exit 1
 }
 command -v node >/dev/null || {

From e4359730f0f1aa034a0b3ca947fd83f38ff724d9 Mon Sep 17 00:00:00 2001
From: Aram Grigoryan <132480+aram356@users.noreply.github.com>
Date: Sun, 6 Sep 2026 14:26:11 -0700
Subject: [PATCH 03/11] Replace deprecated `Array::from_slice` in the proxy URL
 codec

`hybrid_array` deprecates `from_slice` in favour of `TryFrom`, which is
an error under the workspace's `-D warnings` clippy gate.

The encode path builds a fixed `[u8; 24]`, so it converts infallibly
via `XNonce::from`. The decode path takes a runtime slice, so it uses
`XNonce::try_from` and returns `None` on a mismatch, matching the
function's existing `Option` contract; the preceding length check
already guarantees 24 bytes, so this is unreachable in practice and
replaces a path that would previously have panicked.

Both conversions yield an owned `XNonce` where `from_slice` yielded a
reference, so the three use sites borrow explicitly.
---
 crates/trusted-server-core/src/http_util.rs | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/crates/trusted-server-core/src/http_util.rs b/crates/trusted-server-core/src/http_util.rs
index 34656f63d1..15e51cba1b 100644
--- a/crates/trusted-server-core/src/http_util.rs
+++ b/crates/trusted-server-core/src/http_util.rs
@@ -351,15 +351,15 @@ pub fn encode_url(settings: &Settings, plaintext_url: &str) -> String {
     let nonce_full = hasher.finalize();
     let mut nonce = [0_u8; 24];
     nonce[..24].copy_from_slice(&nonce_full[..24]);
-    let nonce = XNonce::from_slice(&nonce);
+    let nonce = XNonce::from(nonce);
 
     let ciphertext = cipher
-        .encrypt(nonce, plaintext_url.as_bytes())
+        .encrypt(&nonce, plaintext_url.as_bytes())
         .expect("encryption failure");
 
     let mut out: Vec<u8> = Vec::with_capacity(2 + 24 + ciphertext.len());
     out.extend_from_slice(b"x1");
-    out.extend_from_slice(nonce);
+    out.extend_from_slice(&nonce);
     out.extend_from_slice(&ciphertext);
     URL_SAFE_NO_PAD.encode(out)
 }
@@ -375,12 +375,12 @@ pub fn decode_url(settings: &Settings, token: &str) -> Option<String> {
         return None;
     }
     let nonce_bytes = &data[2..2 + 24];
-    let nonce = XNonce::from_slice(nonce_bytes);
+    let nonce = XNonce::try_from(nonce_bytes).ok()?;
     let ciphertext = &data[2 + 24..];
 
     let key_bytes = Sha256::digest(settings.publisher.proxy_secret.expose().as_bytes());
     let cipher = XChaCha20Poly1305::new(&key_bytes);
-    let pt = cipher.decrypt(nonce, ciphertext).ok()?;
+    let pt = cipher.decrypt(&nonce, ciphertext).ok()?;
     String::from_utf8(pt).ok()
 }
 

From 445e58780a33db4a934f576e7a931fda1cfbe4e3 Mon Sep 17 00:00:00 2001
From: Aram Grigoryan <132480+aram356@users.noreply.github.com>
Date: Sun, 6 Sep 2026 17:29:15 -0700
Subject: [PATCH 04/11] Drop a redundant `Write` import that Rust 1.98 flags

`publisher.rs` imports `std::io::Write` at file scope, and the test
module's `use super::*` already brings it in, so the module's own
`Write as _` is redundant. Rust 1.98 reports it as an unused import,
which is an error under the workspace's `-D warnings` gate.

Confirmed new to the toolchain rather than pre-existing: clippy on
`main` under 1.95 is clean against the identical pair of imports.
---
 crates/trusted-server-core/src/publisher.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/trusted-server-core/src/publisher.rs b/crates/trusted-server-core/src/publisher.rs
index 40bb7ea277..478f7eb240 100644
--- a/crates/trusted-server-core/src/publisher.rs
+++ b/crates/trusted-server-core/src/publisher.rs
@@ -6644,7 +6644,7 @@ fn mark_deprecated_alias(response: &mut Response<EdgeBody>, is_legacy_alias: boo
 #[cfg(test)]
 mod tests {
     use std::future::Future as _;
-    use std::io::{self, Read as _, Write as _};
+    use std::io::{self, Read as _};
     use std::sync::atomic::{AtomicUsize, Ordering};
 
     use brotli::Decompressor;

From c3cc86896bf46e51595b189981c0504f023f625a Mon Sep 17 00:00:00 2001
From: Aram Grigoryan <132480+aram356@users.noreply.github.com>
Date: Sun, 6 Sep 2026 21:28:40 -0700
Subject: [PATCH 05/11] Drop a redundant `clap::Parser` import that Rust 1.98
 flags

`run.rs` imports `Parser` at file scope, and the test module's
`use super::*` already brings it in, so the module's own
`Parser as _` is redundant. Same shape as the `publisher.rs` case:
new under Rust 1.98, and an error under `-D warnings`.

Missed in the first local pass because `cargo check` on the CLI runs
neither `--all-targets` nor `-D warnings`; CI's clippy does both.
---
 crates/trusted-server-cli/src/run.rs | 1 -
 1 file changed, 1 deletion(-)

diff --git a/crates/trusted-server-cli/src/run.rs b/crates/trusted-server-cli/src/run.rs
index 13009d4484..657de36c1d 100644
--- a/crates/trusted-server-cli/src/run.rs
+++ b/crates/trusted-server-cli/src/run.rs
@@ -134,7 +134,6 @@ fn dispatch(args: Args) -> Result<(), String> {
 mod tests {
     use std::path::PathBuf;
 
-    use clap::Parser as _;
     use edgezero_cli::args::{AuthSub, ConfigDiffArgs, ConfigPushArgs, ConfigValidateArgs};
 
     use super::*;

From e35e19c1eb6a5457dc173b7a889ec1c68a96b775 Mon Sep 17 00:00:00 2001
From: Aram Grigoryan <132480+aram356@users.noreply.github.com>
Date: Sun, 6 Sep 2026 22:37:58 -0700
Subject: [PATCH 06/11] Patch `esi` to a fork carrying the fastly 0.13 range

`esi` 0.7.2 pins `fastly = "^0.12"` while EdgeZero requires 0.13. Both
land in `trusted-server-adapter-fastly`, and `esi_assembly.rs` passes
`fastly::Request` and `Response` across that boundary, so the two
copies meet and the adapter fails to compile.

The fork changes only the version ranges, in the library and the six
examples that pin `fastly` themselves. No source changes: the crate
compiles and its suite passes unmodified against 0.13.

`fastly` 0.12 now drops out of the graph entirely, leaving one copy.

Temporary. Drop this patch once the range bump is released upstream;
tracked in #1122.
---
 Cargo.lock | 87 ++++++++----------------------------------------------
 Cargo.toml |  7 +++++
 2 files changed, 19 insertions(+), 75 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index c77f86d22d..c8a697396c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1542,7 +1542,7 @@ dependencies = [
  "ctor",
  "edgezero-adapter",
  "edgezero-core",
- "fastly 0.13.1",
+ "fastly",
  "fern",
  "flate2",
  "futures",
@@ -1768,14 +1768,13 @@ dependencies = [
 [[package]]
 name = "esi"
 version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "026264c3022569f7bc5052f9452362537e923b34ecc9248b803437c2b89cdd81"
+source = "git+https://github.com/stackpop/esi?rev=75bfbb396#75bfbb396d4cb7792610f1287cbec61675f13f38"
 dependencies = [
  "atoi",
  "base64",
  "bytes",
  "chrono",
- "fastly 0.12.1",
+ "fastly",
  "html-escape",
  "log",
  "md5",
@@ -1809,34 +1808,6 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
 
-[[package]]
-name = "fastly"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "531e4c3df48350d9f4fc95b4deaf87fd29820336b7926bb84bf460457c2a126b"
-dependencies = [
- "anyhow",
- "bytes",
- "downcast-rs",
- "elsa",
- "fastly-macros 0.12.1",
- "fastly-shared 0.12.1",
- "fastly-sys 0.12.1",
- "http",
- "itertools 0.13.0",
- "lazy_static",
- "mime",
- "serde",
- "serde_json",
- "serde_repr",
- "serde_urlencoded",
- "sha2 0.9.9",
- "smallvec",
- "thiserror 1.0.69",
- "time",
- "url",
-]
-
 [[package]]
 name = "fastly"
 version = "0.13.1"
@@ -1847,9 +1818,9 @@ dependencies = [
  "bytes",
  "downcast-rs",
  "elsa",
- "fastly-macros 0.13.1",
- "fastly-shared 0.13.1",
- "fastly-sys 0.13.1",
+ "fastly-macros",
+ "fastly-shared",
+ "fastly-sys",
  "http",
  "itertools 0.13.0",
  "mime",
@@ -1864,17 +1835,6 @@ dependencies = [
  "url",
 ]
 
-[[package]]
-name = "fastly-macros"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc2aef5f9690b04c8890f9a54ddb591b12b9779ec25ee0e572d207106e52e3d8"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
 [[package]]
 name = "fastly-macros"
 version = "0.13.1"
@@ -1886,16 +1846,6 @@ dependencies = [
  "syn 1.0.109",
 ]
 
-[[package]]
-name = "fastly-shared"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "080ad138403159fd366d3e0b14bb49cb0c01dc18c25095bbbd1c85e3338f5413"
-dependencies = [
- "bitflags 1.3.2",
- "http",
-]
-
 [[package]]
 name = "fastly-shared"
 version = "0.13.1"
@@ -1906,19 +1856,6 @@ dependencies = [
  "http",
 ]
 
-[[package]]
-name = "fastly-sys"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de75ef193f6c29c43d667458bede648970715aedd5db2d42c2eba3ffa3ad738b"
-dependencies = [
- "bitflags 1.3.2",
- "fastly-shared 0.12.1",
- "http",
- "wasip2",
- "wit-bindgen 0.51.0",
-]
-
 [[package]]
 name = "fastly-sys"
 version = "0.13.1"
@@ -1926,7 +1863,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "239c77706cf9110b423a89b6b03b8011729b144390d2a7f641d95ef66b2768b8"
 dependencies = [
  "bitflags 1.3.2",
- "fastly-shared 0.13.1",
+ "fastly-shared",
  "http",
  "wasip2",
  "wit-bindgen 0.51.0",
@@ -3001,7 +2938,7 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "433713b6191ad3e1d5248db9536f3e2d99a12d7ff998afd272a98d96e6dbc2ed"
 dependencies = [
- "fastly 0.13.1",
+ "fastly",
  "log",
  "regex",
 ]
@@ -3781,7 +3718,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
 dependencies = [
  "heck",
- "itertools 0.13.0",
+ "itertools 0.10.5",
  "log",
  "multimap",
  "once_cell",
@@ -3801,7 +3738,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
 dependencies = [
  "anyhow",
- "itertools 0.13.0",
+ "itertools 0.10.5",
  "proc-macro2",
  "quote",
  "syn 2.0.118",
@@ -3814,7 +3751,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
 dependencies = [
  "anyhow",
- "itertools 0.13.0",
+ "itertools 0.10.5",
  "proc-macro2",
  "quote",
  "syn 2.0.118",
@@ -5509,7 +5446,7 @@ dependencies = [
  "edgezero-core",
  "error-stack",
  "esi",
- "fastly 0.13.1",
+ "fastly",
  "fern",
  "futures",
  "log",
diff --git a/Cargo.toml b/Cargo.toml
index 6db2c0b747..55a656d6b9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -131,6 +131,13 @@ which = "8"
 worker = { version = "0.8", default-features = false, features = ["http"] }
 x509-parser = "0.16"
 
+# `esi` 0.7.2 pins `fastly = "^0.12"` while EdgeZero requires 0.13, and both
+# meet in `trusted-server-adapter-fastly`. The fork carries the range bump
+# and no source change (stackpop/esi@chore/fastly-0.13); drop this patch
+# once the fix is released upstream. See issue #1122.
+[patch.crates-io]
+esi = { git = "https://github.com/stackpop/esi", rev = "75bfbb396" }
+
 [workspace.lints.clippy]
 # Correctness - Force explicit error handling in production code
 unwrap_used = "deny"

From 2ad9268e8e19bb63db1fedc2c5d53f5632cdc7f8 Mon Sep 17 00:00:00 2001
From: Aram Grigoryan <132480+aram356@users.noreply.github.com>
Date: Mon, 7 Sep 2026 00:55:18 -0700
Subject: [PATCH 07/11] Restore the version placeholders in the getting-started
 guide

`{{RUST_VERSION}}` and `{{NODEJS_VERSION}}` were replaced with literal
versions on the mistaken belief that nothing substituted them. VitePress
does: `docs/.vitepress/config.mts` installs a markdown hook that reads
`.tool-versions` and replaces `{{<TOOL>_VERSION}}` for every tool listed
there. `{{FASTLY_VERSION}}`, four lines below in the same file, was
already relying on it.

Hardcoding the numbers dropped the guide out of that mechanism, so it
would have silently gone stale at the next toolchain bump. The
placeholders now resolve from the versions updated earlier in this
branch; verified against a real `npm run build`, whose rendered HTML
reads "Rust 1.98.1", "NodeJS 24.20.0" and "Fastly 16.0.0" with no
placeholder left unsubstituted.
---
 docs/guide/getting-started.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
index d6cbc916f7..dd9e621880 100644
--- a/docs/guide/getting-started.md
+++ b/docs/guide/getting-started.md
@@ -6,8 +6,8 @@ Get up and running with Trusted Server quickly.
 
 Before you begin, ensure you have the following installed (versions are pinned in `.tool-versions`):
 
-- Rust 1.98.1 (see `.tool-versions`)
-- NodeJS 24.20.0
+- Rust {{RUST_VERSION}} (see `.tool-versions`)
+- NodeJS {{NODEJS_VERSION}}
 - Basic familiarity with Rust and WebAssembly
 
 **For Fastly deployment** (optional for local dev):

From 7528279c09987fb472d023582aa09dadc84b21d6 Mon Sep 17 00:00:00 2001
From: Aram Grigoryan <132480+aram356@users.noreply.github.com>
Date: Thu, 15 Oct 2026 22:43:03 -0700
Subject: [PATCH 08/11] Declare and enforce the Spin 4.1 runtime minimum

`spin-sdk` 7 imports `wasi:http/types@0.3.0`, which Spin 4.0.x does not
provide, so the SDK upgrade in this branch makes the component
unstartable on those runtimes. Nothing in the build catches it: the
component compiles, `cargo test-spin` passes, and only `spin up` fails,
reporting an unresolved import against the linker.

`scripts/smoke-common.sh` gains `smoke_require_spin_version`, which
parses `spin --version` and refuses anything below 4.1.0 with a message
naming the found version, the reason, and the install URL. It fails
closed when the version cannot be parsed or `spin --version` does not
run, so a broken toolchain cannot look like a pass. Comparison uses
`sort -V`, so 4.10.0 orders above 4.1.0 as it should. The smoke calls it
after the existing command checks, before building or starting the app.

`docs/guide/spin.md` gains a prerequisites section carrying the
requirement, the linker error it otherwise produces, and the note that
the smoke now catches it. The "With the Spin CLI installed" line that
opens the verification section now names the version.

No `.tool-versions` entry. asdf has no first-party Spin plugin, so a pin
would make `asdf install` fail until every developer added a third-party
one, and CI never installs or runs the Spin runtime (`test-spin` only
checks, builds and tests). The preflight enforces the floor where the
runtime is actually used.

Verified: the gate accepts 4.1.0, 4.10.0, 5.0.0 and 10.0.0, rejects
4.0.0, 4.0.3 and 3.9.9, and fails closed on unparseable output and a
non-zero exit. shellcheck clean on both scripts. Running the real
`./scripts/smoke-spin.sh` passes the preflight against the local Spin
4.1.0 and proceeds to build and launch; it then fails on an app-config
diagnostic assertion that fails identically on `main` at fa9837f2b, so
that failure is pre-existing and unrelated to this change.
---
 docs/guide/spin.md      | 19 ++++++++++++++++++-
 scripts/smoke-common.sh | 17 +++++++++++++++++
 scripts/smoke-spin.sh   |  1 +
 3 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/docs/guide/spin.md b/docs/guide/spin.md
index a0e2f8fd31..30bf06b299 100644
--- a/docs/guide/spin.md
+++ b/docs/guide/spin.md
@@ -15,9 +15,26 @@ auction provider. When startup fails, its hardened router preserves `/health`
 but answers publisher routes with 503; neither response proves successful
 configuration.
 
+## Prerequisites
+
+Spin 4.1.0 or newer. `spin-sdk` 7 imports `wasi:http/types@0.3.0`, which Spin
+4.0.x does not provide, so an older runtime cannot start the component. Install
+or upgrade from the [Spin install guide](https://spinframework.dev/install).
+
+Nothing in the build catches this. The component compiles, `cargo
+test-spin` passes, and only `spin up` reports:
+
+```
+Error: component imports instance `wasi:http/types@0.3.0`, but a
+matching implementation was not found in the linker
+```
+
+`./scripts/smoke-spin.sh` checks the runtime version before it starts the app,
+so it fails with a clear message rather than that linker error.
+
 ## Verify the complete local handoff
 
-With the Spin CLI installed, run:
+With Spin 4.1.0 or newer installed, run:
 
 ```bash
 ./scripts/smoke-spin.sh
diff --git a/scripts/smoke-common.sh b/scripts/smoke-common.sh
index 9335c42ddd..df7cd72e56 100644
--- a/scripts/smoke-common.sh
+++ b/scripts/smoke-common.sh
@@ -12,6 +12,23 @@ smoke_require_command() {
     command -v "$1" >/dev/null 2>&1 || smoke_die "required command not found: $1"
 }
 
+smoke_require_spin_version() {
+    # spin-sdk 7 imports wasi:http/types@0.3.0, which Spin 4.0.x cannot link.
+    local minimum="4.1.0"
+    local raw
+    raw=$(spin --version 2>/dev/null) || smoke_die "could not run: spin --version"
+    local found
+    found=$(printf '%s\n' "$raw" | sed -n '1s/^spin \([0-9][0-9.]*\).*/\1/p')
+    [ -n "$found" ] || smoke_die "could not parse a version from: $raw"
+    # The component still builds and its tests still pass, so only `spin up`
+    # surfaces the mismatch; check the runtime before starting the app.
+    local lowest
+    lowest=$(printf '%s\n%s\n' "$minimum" "$found" | sort -V | head -1)
+    if [ "$lowest" != "$minimum" ]; then
+        smoke_die "spin $minimum or newer is required (found $found); spin-sdk 7 imports wasi:http/types@0.3.0, which earlier runtimes cannot link. Install from https://spinframework.dev/install"
+    fi
+}
+
 smoke_make_workspace() {
     local adapter="$1"
     local base="${TMPDIR:-/tmp}"
diff --git a/scripts/smoke-spin.sh b/scripts/smoke-spin.sh
index 382f02ca83..3384dcf03b 100755
--- a/scripts/smoke-spin.sh
+++ b/scripts/smoke-spin.sh
@@ -12,6 +12,7 @@ smoke_require_command curl
 smoke_require_command python3
 smoke_require_command spin
 smoke_require_command pgrep
+smoke_require_spin_version
 
 WORKSPACE=$(smoke_make_workspace spin)
 ORIGIN_PORT=${SPIN_SMOKE_ORIGIN_PORT:-19189}

From 5c850c69058c3034e0b8bd9fd3865c9fe700a95b Mon Sep 17 00:00:00 2001
From: Aram Grigoryan <132480+aram356@users.noreply.github.com>
Date: Thu, 15 Oct 2026 22:49:14 -0700
Subject: [PATCH 09/11] Pin Spin in .tool-versions and read the floor from it

Adds `spin 4.1.0` to `.tool-versions` and makes the smoke preflight read
its minimum from that line instead of hardcoding one, so the pin and the
check cannot drift. A missing `spin` entry now fails closed rather than
silently skipping the gate.

Every consumer of `.tool-versions` looks up one tool at a time, with
`awk '$1 == "..."'` or `grep '^<tool> '`, so the new line is inert to
the workflows and scripts that read the file; the helper uses the same
awk form. CI never calls `asdf install`, so an entry asdf cannot resolve
does not break it.

That resolution gap is real, though: asdf has no first-party Spin
plugin, so `asdf install` will not provide this one. The Spin guide now
says so, and points at the install guide or a community plugin. The pin
records the required version and is what the smoke checks against.

Also adds the Spin row to the `AGENTS.md` toolchain table, which lists
the other pinned tools.

Verified: the helper resolves the pin from any working directory via
`BASH_SOURCE`; bumping the pin to 9.9.9 in a scratch copy rejects the
local Spin 4.1.0, and deleting the line reports the missing pin, so the
file genuinely drives the floor. The version gate is unchanged, still
accepting 4.1.0, 4.10.0 and 10.0.0 and rejecting 4.0.3 and 3.9.9.
shellcheck clean, `cargo check-spin` clean, `cargo test-spin` 88 tests
passing, both markdown format gates clean.
---
 .tool-versions          |  1 +
 AGENTS.md               |  1 +
 docs/guide/spin.md      | 11 ++++++++---
 scripts/smoke-common.sh |  9 +++++++--
 4 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/.tool-versions b/.tool-versions
index bdc115f84c..d29345dba2 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -3,5 +3,6 @@ rust      1.98.1
 nodejs    24.20.0
 viceroy   0.21.0
 wasmtime  48.0.1
+spin      4.1.0
 awscli    2.36.45
 terraform 1.16.2
diff --git a/AGENTS.md b/AGENTS.md
index d37906421a..b299f3cf85 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -39,6 +39,7 @@ Supporting files: `edgezero.toml`, `fastly.toml`,
 | Fastly CLI  | 16.0.0 (from `.tool-versions`)           |
 | Viceroy     | 0.21.0 (from `.tool-versions`)           |
 | Wasmtime    | 48.0.1 (from `.tool-versions`)           |
+| Spin        | 4.1.0 (from `.tool-versions`)            |
 | AWS CLI     | 2.36.45 (from `.tool-versions`)          |
 | Terraform   | 1.16.2 (from `.tool-versions`)           |
 
diff --git a/docs/guide/spin.md b/docs/guide/spin.md
index 30bf06b299..1a0b5c5a7f 100644
--- a/docs/guide/spin.md
+++ b/docs/guide/spin.md
@@ -17,9 +17,14 @@ configuration.
 
 ## Prerequisites
 
-Spin 4.1.0 or newer. `spin-sdk` 7 imports `wasi:http/types@0.3.0`, which Spin
-4.0.x does not provide, so an older runtime cannot start the component. Install
-or upgrade from the [Spin install guide](https://spinframework.dev/install).
+Spin 4.1.0 or newer, pinned as `spin` in `.tool-versions`. `spin-sdk` 7 imports
+`wasi:http/types@0.3.0`, which Spin 4.0.x does not provide, so an older runtime
+cannot start the component. Install or upgrade from the
+[Spin install guide](https://spinframework.dev/install).
+
+asdf has no first-party Spin plugin, so `asdf install` does not provide this
+one; install it directly, or add a community plugin if you want asdf to manage
+it. The pin records the required version and is what the smoke checks against.
 
 Nothing in the build catches this. The component compiles, `cargo
 test-spin` passes, and only `spin up` reports:
diff --git a/scripts/smoke-common.sh b/scripts/smoke-common.sh
index df7cd72e56..4885472c47 100644
--- a/scripts/smoke-common.sh
+++ b/scripts/smoke-common.sh
@@ -13,8 +13,13 @@ smoke_require_command() {
 }
 
 smoke_require_spin_version() {
-    # spin-sdk 7 imports wasi:http/types@0.3.0, which Spin 4.0.x cannot link.
-    local minimum="4.1.0"
+    # `.tool-versions` is the single source of truth for the pinned version, so
+    # the floor is read from there rather than restated here. spin-sdk 7 imports
+    # wasi:http/types@0.3.0, which Spin 4.0.x cannot link.
+    local versions="${BASH_SOURCE[0]%/*}/../.tool-versions"
+    local minimum
+    minimum=$(awk '$1 == "spin" { print $2; exit }' "$versions" 2>/dev/null)
+    [ -n "$minimum" ] || smoke_die "no spin version pinned in .tool-versions"
     local raw
     raw=$(spin --version 2>/dev/null) || smoke_die "could not run: spin --version"
     local found

From b17d64bd28b113e70d9319d6c6ee9b52969180cf Mon Sep 17 00:00:00 2001
From: Aram Grigoryan <132480+aram356@users.noreply.github.com>
Date: Thu, 15 Oct 2026 23:27:38 -0700
Subject: [PATCH 10/11] Install worker-build with --locked

The Cloudflare bundle step installs `worker-build` without `--locked`,
so Cargo re-resolves its whole dependency tree on every install. That
tree is not resolvable: `worker-build` depends on `binary-install`
0.4.1, which requires `zip ^2.1.3`, and the entire `zip` 2.x line is
yanked. `binary-install` 0.4.1 is still the newest release, and the
current `worker-build` 0.8.7 depends on it too, so there is no version
pair to upgrade to.

This surfaced now rather than in May 2025, when `zip` 2.6.1 was yanked,
because a warm Cargo index kept serving a resolvable answer. Yanking
`zip` 9.0.2 on 2026-10-16 at 03:33Z refreshed the index, and the next
fresh resolve failed. Runs from 21:27Z the previous evening passed on
the stale index, which is why other open PRs look unaffected.

`--locked` installs against the lockfile `worker-build` publishes, which
pins a working `zip`, so upstream yanks in versions it never selected
cannot break the install. Verified both directions with the exact
command the step runs: `cargo install -q --force --version "=0.8.5"
--locked worker-build` succeeds, and the same command without `--locked`
fails on the yanked `zip` versions. Matches the `--locked` already used
for the Viceroy install in the same workflow.
---
 crates/trusted-server-adapter-cloudflare/build.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/crates/trusted-server-adapter-cloudflare/build.sh b/crates/trusted-server-adapter-cloudflare/build.sh
index dcabdee8eb..1ddf5321d1 100644
--- a/crates/trusted-server-adapter-cloudflare/build.sh
+++ b/crates/trusted-server-adapter-cloudflare/build.sh
@@ -33,4 +33,9 @@ if [ -z "$WORKER_VERSION" ]; then
   echo "error: could not determine the worker crate version from Cargo.lock" >&2
   exit 1
 fi
-cargo install -q --force --version "=$WORKER_VERSION" worker-build && worker-build --release
+# `--locked` installs against the lockfile worker-build publishes, rather
+# than re-resolving its dependency tree. Without it the install breaks on
+# upstream yanks it has no say over: `binary-install` 0.4.1 requires
+# `zip ^2.1.3`, and the whole `zip` 2.x line is yanked, so a fresh resolve
+# fails outright. A warm Cargo index masked this until the index refreshed.
+cargo install -q --force --version "=$WORKER_VERSION" --locked worker-build && worker-build --release

From 4c5ca8ae52deb269e445eb7bc084e19631a63cfa Mon Sep 17 00:00:00 2001
From: Aram Grigoryan <132480+aram356@users.noreply.github.com>
Date: Sat, 17 Oct 2026 10:38:18 -0700
Subject: [PATCH 11/11] Drop the getrandom 0.4 pin and tighten the esi rev
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three review findings from dhruv8sh on #1123.

The `getrandom_04` renamed-package entry is gone, and with it the
`wasm_js` wiring in `trusted-server-core`. The entry was justified by a
wrong diagnosis: `sha2` does not pull getrandom 0.4. `crypto-common`
0.2 declares it `optional = true` behind a `getrandom` feature, and the
only thing enabling that feature is `chacha20poly1305`'s own default
`getrandom` → `aead/getrandom` → `crypto-common/getrandom`. Turning off
that default removes getrandom 0.4 from the Cloudflare graph entirely
rather than configuring it.

Safe because the XChaCha nonce is derived from SHA-256 for stable
tokens, not drawn from the AEAD's RNG: `http_util.rs` imports only
`Aead` and `KeyInit`, and nothing in the workspace calls
`generate_nonce` or `generate_key`. The two `OsRng` uses are ed25519
key generation through `rand`, untouched by this.

Confirmed the ciphertext does not move. A scratch crate encrypting a
fixed URL with a fixed secret produces the same bytes with default
features on and off:

  5a0f9fca0c02d1f46d2e00e67c3fd00ba5d825784329f4b3b5b588bbbe77b7ca...

so persisted proxy URL tokens stay valid. `cargo tree -i
getrandom@0.4.3` on `wasm32-unknown-unknown` now reports nothing; the
crate remains only on `wasm32-wasip1` via esi's `rand` and `uuid`,
which have native RNG and never needed the feature.

The esi patch rev is now the full 40-character SHA rather than a
9-character prefix, which is unambiguous on fetch. Verified it is the
same commit the lockfile already resolved.

On the fourth finding, the `spin` pin in `.tool-versions`: keeping it.
`fastly` and `viceroy` have no asdf plugin at all and have been pinned
there all along, while `spin` at least has a community one, so the file
is already an inventory of required versions rather than a strictly
asdf-installable manifest. `docs/guide/onboarding.md` says "asdf or
another version manager", and `docs/guide/spin.md` already documents
the missing plugin. CI is unaffected: every consumer greps one tool at
a time.

Verified: fmt clean, clippy-cloudflare-wasm, clippy-fastly and
clippy-spin-wasm clean, test-fastly (221 + 2944 + 10 + 10 + 21 + 4),
test-cloudflare, test-axum all passing.
---
 Cargo.lock                            | 15 +++++----------
 Cargo.toml                            |  9 ++-------
 crates/trusted-server-core/Cargo.toml |  1 -
 3 files changed, 7 insertions(+), 18 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index ad6a5c9470..7ebc0b08ea 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1077,9 +1077,7 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
- "getrandom 0.4.3",
  "hybrid-array",
- "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -1834,7 +1832,7 @@ dependencies = [
 [[package]]
 name = "esi"
 version = "0.7.2"
-source = "git+https://github.com/stackpop/esi?rev=75bfbb396#75bfbb396d4cb7792610f1287cbec61675f13f38"
+source = "git+https://github.com/stackpop/esi?rev=75bfbb396d4cb7792610f1287cbec61675f13f38#75bfbb396d4cb7792610f1287cbec61675f13f38"
 dependencies = [
  "atoi",
  "base64",
@@ -2211,11 +2209,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
- "js-sys",
  "libc",
  "r-efi 6.0.0",
  "rand_core 0.10.1",
- "wasm-bindgen",
 ]
 
 [[package]]
@@ -2598,7 +2594,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c91d8cffac8849493a82233811bd02b2b183b8cf39bf704de0fa0841b737595"
 dependencies = [
  "bstr",
- "hashbrown 0.17.1",
+ "hashbrown 0.16.1",
 ]
 
 [[package]]
@@ -4794,7 +4790,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
 dependencies = [
  "heck",
- "itertools 0.13.0",
+ "itertools 0.10.5",
  "log",
  "multimap",
  "once_cell",
@@ -4814,7 +4810,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
 dependencies = [
  "anyhow",
- "itertools 0.13.0",
+ "itertools 0.10.5",
  "proc-macro2",
  "quote",
  "syn 2.0.118",
@@ -4827,7 +4823,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
 dependencies = [
  "anyhow",
- "itertools 0.13.0",
+ "itertools 0.10.5",
  "proc-macro2",
  "quote",
  "syn 2.0.118",
@@ -6706,7 +6702,6 @@ dependencies = [
  "flate2",
  "futures",
  "getrandom 0.2.17",
- "getrandom 0.4.3",
  "glob",
  "hex",
  "hmac",
diff --git a/Cargo.toml b/Cargo.toml
index 33476ff16c..72fecdf6b5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -45,7 +45,7 @@ base64 = "0.22"
 brotli = "8.0"
 build-print = "1.0.1"
 bytes = "1.11"
-chacha20poly1305 = "0.11"
+chacha20poly1305 = { version = "0.11", default-features = false, features = ["alloc"] }
 chrono = "0.4.44"
 chromiumoxide = "0.9.1"
 clap = { version = "4", features = ["derive"] }
@@ -75,11 +75,6 @@ futures = "0.3"
 gix = { version = "0.83", default-features = false }
 glob = "0.3"
 getrandom = "0.2"
-# `sha2` 0.11 pulls `crypto-common` 0.2, which depends on getrandom 0.4.
-# Both lines coexist in the graph; 0.4 renamed the browser RNG feature
-# from `js` to `wasm_js`, so it needs its own pin to enable it on
-# `wasm32-unknown-unknown`.
-getrandom_04 = { package = "getrandom", version = "0.4" }
 hex = "0.4.3"
 hmac = "0.13"
 http = "1.4.0"
@@ -142,7 +137,7 @@ x509-parser = "0.16"
 # and no source change (stackpop/esi@chore/fastly-0.13); drop this patch
 # once the fix is released upstream. See issue #1122.
 [patch.crates-io]
-esi = { git = "https://github.com/stackpop/esi", rev = "75bfbb396" }
+esi = { git = "https://github.com/stackpop/esi", rev = "75bfbb396d4cb7792610f1287cbec61675f13f38" }
 
 [workspace.lints.clippy]
 # Correctness - Force explicit error handling in production code
diff --git a/crates/trusted-server-core/Cargo.toml b/crates/trusted-server-core/Cargo.toml
index 2e5ec8de27..0a8d052805 100644
--- a/crates/trusted-server-core/Cargo.toml
+++ b/crates/trusted-server-core/Cargo.toml
@@ -57,7 +57,6 @@ web-time = { workspace = true }
 # The Fastly adapter uses `wasm32-wasip1`, which has native POSIX RNG and does not
 # need these — this block is intentionally scoped to `target_os = "unknown"` only.
 getrandom = { workspace = true, features = ["js"] }
-getrandom_04 = { workspace = true, features = ["wasm_js"] }
 uuid = { workspace = true, features = ["js"] }
 # `chrono::Utc::now()` calls `std::time::SystemTime::now()`, which panics on
 # `wasm32-unknown-unknown`, unless `wasmbind` makes it read the JS clock.