chore: wrap crate / JS dep bump plus a rustup + cargo-upgrade pass on up.

package.json

@@ -75,17 +75,17 @@
     "@shadcn/lint": "^0.2.0",
     "@stylistic/eslint-plugin": "^5.10.0",
     "@tanstack/eslint-plugin-router": "^1.162.0",
-    "@tanstack/intent": "^0.5.3",
+    "@tanstack/intent": "^0.5.4",
     "@types/bun": "^1.4.2",
     "@types/node": "^26.6.4",
     "bun-scan": "^1.1.2",
     "git-cliff": "^2.14.2",
     "knip": "^6.39.0",
     "npm-check-updates": "^23.1.0",
-    "oxfmt": "^0.71.0",
-    "oxlint": "^1.86.0",
+    "oxfmt": "^0.72.0",
+    "oxlint": "^1.87.0",
     "oxlint-tsgolint": "^7.0.2003",
-    "react-doctor": "^0.9.14",
+    "react-doctor": "^0.9.17",
     "rimraf": "^6.1.3",
     "turbo": "^2.11.7",
     "typescript": "^7.0.2"

packages/agent-skills/package.json

@@ -33,7 +33,7 @@
     "sync-versions": "bun ../../scripts/skills/sync-versions.ts"
   },
   "devDependencies": {
-    "@tanstack/intent": "^0.5.3",
+    "@tanstack/intent": "^0.5.4",
     "@types/bun": "^1.4.2"
   }
 }

packages/agent/Cargo.toml

@@ -2,7 +2,6 @@
 name = "agent"
 version = "0.7.4"
 edition = "2024"
-rust-version = "1.98"
 publish = false
 description = "monrep outbound tunnel agent — 1:1 control plane, supervised runtime"
 
@@ -14,12 +13,12 @@ path = "src/main.rs"
 anyhow = "1.0.104"
 clap = { version = "4.6.7", features = ["derive"] }
 directories = "6.0.0"
-fs-err = "3.3.1"
+fs-err = "3.3.2"
 reqwest = { version = "0.13.5", default-features = false, features = ["json", "rustls", "stream"] }
 serde = { version = "1.0.229", features = ["derive"] }
 serde_json = "1.0.151"
 thiserror = "2.0.21"
-tokio = { version = "1.53.1", features = [
+tokio = { version = "1.53.2", features = [
   "io-util",
   "macros",
   "net",
@@ -33,14 +32,14 @@ tokio-tungstenite = { version = "0.30.0", default-features = false, features = [
   "connect",
   "rustls-tls-webpki-roots",
 ] }
-futures-util = { version = "0.3.31", default-features = false, features = ["sink"] }
+futures-util = { version = "0.3.34", default-features = false, features = ["sink"] }
 rustls = "0.23.45"
 rustls-pemfile = "2.2.0"
 webpki-roots = "1.0.9"
 portable-pty = "0.9.0"
 base64 = "0.23.1"
 rusqlite = { version = "0.40.2", features = ["bundled"] }
-libc = "0.2.189"
+libc = "0.2.190"
 
 [profile.release]
 lto = "fat"

packages/codegen/package.json

@@ -19,7 +19,7 @@
   },
   "dependencies": {
     "@monrep/utils": "workspace:^",
-    "@tanstack/pacer": "0.23.0"
+    "@tanstack/pacer": "0.23.1"
   },
   "devDependencies": {
     "@types/bun": "^1.4.2",

packages/db/package.json

@@ -26,7 +26,7 @@
     "@durable-streams/server-cloudflare": "^0.1.1",
     "@durable-streams/state": "^0.3.2",
     "@monrep/utils": "workspace:^",
-    "@tanstack/react-db": "^0.5.3",
+    "@tanstack/react-db": "^0.5.4",
     "@tanstack/react-store": "^0.11.2",
     "zod": "^4.6.5"
   },

packages/hooks/package.json

@@ -16,7 +16,7 @@
   },
   "dependencies": {
     "@formkit/auto-animate": "^0.10.0",
-    "@tanstack/react-pacer": "^0.24.0"
+    "@tanstack/react-pacer": "^0.24.1"
   },
   "devDependencies": {
     "@types/react": "^19.3.0",

packages/main/package.json

@@ -33,7 +33,7 @@
     "@simplewebauthn/browser": "^14.0.0",
     "@simplewebauthn/server": "^14.0.3",
     "@tanstack/charts": "^1.0.0",
-    "@tanstack/react-db": "^0.5.3",
+    "@tanstack/react-db": "^0.5.4",
     "@tanstack/react-router": "^1.170.41",
     "@tanstack/react-start": "^1.168.60",
     "@tanstack/react-store": "^0.11.2",
@@ -57,12 +57,12 @@
     "@types/node": "^26.6.4",
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
-    "@vitejs/plugin-react": "^6.1.1",
+    "@vitejs/plugin-react": "^6.1.2",
     "babel-plugin-react-compiler": "^1.0.0",
-    "oxc-transform-react": "^0.152.0",
+    "oxc-transform-react": "^0.153.0",
     "tailwindcss": "^4.3.3",
     "typescript": "^7.0.2",
-    "vite": "^8.3.2",
+    "vite": "^8.3.3",
     "vite-bundle-analyzer": "^1.3.9",
     "wrangler": "^4.147.0"
   }

packages/ui/package.json

@@ -30,8 +30,8 @@
     "@monrep/runtime": "workspace:^",
     "@monrep/utils": "workspace:^",
     "@ncdai/react-wheel-picker": "^1.2.3",
-    "@tanstack/react-hotkeys": "^0.12.1",
-    "@tanstack/react-pacer": "^0.24.0",
+    "@tanstack/react-hotkeys": "^0.13.0",
+    "@tanstack/react-pacer": "^0.24.1",
     "@tanstack/react-store": "^0.11.2",
     "@tanstack/react-virtual": "^3.14.13",
     "class-variance-authority": "^0.7.1",

scripts/stack/up-dev.ts

@@ -26,6 +26,9 @@ if (existsSync(agentSkillsDir)) {
   run(["printf", "%s\n", "\x1b[31mTODO: Re-enable skills:check when claudflare skills fix the type issues in their md ts/tsx files\x1b[0m"]);
 }
 
+// rustup stable + wrap Cargo.toml / Cargo.lock (never cargo-update inside upstream/)
+run(["bun", "run", "scripts/upgrade/rust.ts"]);
+
 // Vendored submodule pins → origin/HEAD (see scripts/upgrade/upstream.ts)
 if (existsSync(path.join(process.cwd(), ".git"))) {
   run(["bun", "run", "scripts/upgrade/upstream.ts"]);

scripts/upgrade/rust.ts

@@ -0,0 +1,117 @@
+#!/usr/bin/env bun
+/// <reference types="bun" />
+
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { dirname, join, relative } from "node:path";
+import { isGitmodulePath, readGitmodules } from "../utils/gitmodules";
+import { exitIfCi } from "../utils/is-ci";
+import { findFiles } from "../utils/walk";
+
+exitIfCi("\nCI detected — skipping Rust toolchain / wrap crate upgrade\n");
+
+const ROOT = process.cwd();
+const SUBMODULES = readGitmodules(join(ROOT, ".gitmodules"));
+const COMPONENTS = ["rustfmt", "clippy", "rust-analyzer", "rust-src"] as const;
+
+async function run(cmd: Array<string>, cwd: string) {
+  const proc = Bun.spawn({
+    cmd,
+    cwd,
+    stdout: "inherit",
+    stderr: "inherit",
+  });
+  const code = await proc.exited;
+  if (code !== 0) process.exit(code);
+}
+
+async function capture(cmd: Array<string>, cwd: string, allowFail = false): Promise<string> {
+  const proc = Bun.spawn({
+    cmd,
+    cwd,
+    stdout: "pipe",
+    stderr: allowFail ? "pipe" : "inherit",
+  });
+  const text = await new Response(proc.stdout).text();
+  const code = await proc.exited;
+  if (code !== 0 && !allowFail) process.exit(code);
+  return text.trim();
+}
+
+function hasRustup(): boolean {
+  const proc = Bun.spawnSync({
+    cmd: ["rustup", "--version"],
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  return proc.exitCode === 0;
+}
+
+async function findCargoTomls(dir: string) {
+  return findFiles(dir, (name) => name === "Cargo.toml", {
+    skipDirs: ["miri"],
+    ignore: ({ rel, isDirectory }) => isDirectory && isGitmodulePath(rel, SUBMODULES),
+  });
+}
+
+async function hashManifest(cwd: string) {
+  const toml = await readFile(join(cwd, "Cargo.toml"), "utf8");
+  const lockPath = join(cwd, "Cargo.lock");
+  const lock = existsSync(lockPath) ? await readFile(lockPath, "utf8") : "";
+  return `${toml}\n${lock}`;
+}
+
+async function ensureCargoEdit() {
+  const proc = Bun.spawnSync({
+    cmd: ["cargo", "upgrade", "--help"],
+    cwd: ROOT,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  if (proc.exitCode === 0) return;
+  console.log("  installing cargo-edit (cargo upgrade)…\n");
+  await run(["cargo", "install", "cargo-edit", "--locked"], ROOT);
+}
+
+console.log("\n🔄 Updating Rust toolchain + wrap crates…\n");
+
+if (!hasRustup()) {
+  console.error("rustup is required. Install: https://rustup.rs\n");
+  process.exit(1);
+}
+
+await run(["rustup", "self", "update"], ROOT);
+// await run(["rustup", "update", "stable"], ROOT);
+await run(["rustup", "update"], ROOT);
+await run(["rustup", "component", "add", ...COMPONENTS], ROOT);
+
+const rustc = await capture(["rustc", "--version"], ROOT);
+console.log(`  rustc ${rustc}\n`);
+
+await ensureCargoEdit();
+
+const manifests = await findCargoTomls(ROOT);
+if (manifests.length === 0) {
+  console.log("  ✓ no wrap Cargo.toml (submodules skipped)\n");
+  console.log("✅ Rust toolchain updated\n");
+  process.exit(0);
+}
+
+for (const manifest of manifests) {
+  const cwd = dirname(manifest);
+  console.log(`→ ${relative(ROOT, cwd)}`);
+
+  const before = await hashManifest(cwd);
+  await run(["cargo", "upgrade", "--incompatible", "--pinned"], cwd);
+  await run(["cargo", "update"], cwd);
+  // await run(["cargo", "tree", "-p", "whatsapp-rust", "--depth", "1"], cwd);
+  const after = await hashManifest(cwd);
+
+  if (before === after) {
+    console.log("  ✓ Cargo.toml / Cargo.lock unchanged\n");
+  } else {
+    console.log("  ↑ wrap crate dependencies refreshed\n");
+  }
+}
+
+console.log("✅ Rust toolchain + wrap crates updated\n");