huskies: merge 1022

Cargo.lock

@@ -2344,9 +2344,9 @@ dependencies = [
 
 [[package]]
 name = "kqueue-sys"
-version = "1.1.1"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "285efcf12ef41bec907b3000d5ffaeb54191d4d9d83c0d6157e6cbc2db255e64"
+checksum = "07293a4e297ac234359b510362495713f75ea345d5307140414f20c69ffeb087"
 dependencies = [
  "bitflags 2.11.1",
  "libc",

Cargo.toml

@@ -38,6 +38,18 @@ uuid = { version = "1.23.1", features = ["v4", "serde"] }
 tokio-tungstenite = { version = "0.29.0", features = ["connect", "rustls-tls-native-roots"] }
 walkdir = "2.5.0"
 filetime = "0.2"
+# Pinned to 0.16.x: matrix-sdk 0.17.0 uses Duration::from_mins (stabilised in
+# Rust 1.93) and declares rust-version = "1.93".  Our toolchain is 1.90 and the
+# rustup directory is read-only in this environment, so 0.17 cannot be compiled.
+# Once the image ships Rust ≥1.93, bump this to "0.17" and remove this comment.
+#
+# rand@0.8 residual (unavoidable on 0.16.x): vodozemac v0.9, oauth2 v5, and
+# ruma-common v0.17 all depend on rand 0.8.  These are eliminated in matrix-sdk
+# 0.17 where vodozemac moves to 0.10 and ruma to 0.15; until then the residual
+# is intentional and audited — no hand-rolled crypto is involved.
+#
+# libsqlite3-sys: both matrix-sdk-sqlite 0.16 (via rusqlite 0.37) and sqlx
+# 0.9.0-alpha.1 resolve to libsqlite3-sys 0.35.0; there is no version conflict.
 matrix-sdk = { version = "0.16", default-features = false, features = [
     "rustls-tls",
     "sqlite",