chore(deps): bump tower-http from 0.7.0 to 0.7.1

[dependabot]

Bumps tower-http from 0.7.0 to 0.7.1.

Release notes

Sourced from tower-http's releases.

tower-http-0.7.1

Added

• fs: add ServeDir::redirect_to_trailing_slash() to serve directory indexes directly instead of first redirecting to the trailing-slash path. The redirect remains the default (#728)
• fs: add ignore_multi_range_requests() to ServeDir and ServeFile, serving the full representation when a request asks for multiple byte ranges. The existing 416 Range Not Satisfiable response remains the default (#727)
• request-id: the constructors and accessors on the request-id layers, services, and RequestId are now const fn, so they can be used in const context (#716)

Changed

• fs: the minimum http-range-header requirement is now 0.4.2 (#661)

Fixed

• behavioral change: fs: make ServeDir::try_call propagate expected filesystem I/O errors when no fallback is configured, as documented, instead of converting them to 404 Not Found responses (#718)
• decompression: don't end the body when a data frame with no remaining bytes arrives after the decompressor reports end-of-stream. Trailers following such a frame were dropped and could not be recovered (#722)
• decompression: return a body error when a data frame with remaining bytes arrives after the decompressor reports end-of-stream, rather than silently truncating. This regressed in 0.7.0 (#712)
• fs: multipart range requests are now rejected before range validation, so they consistently return 416 Range Not Satisfiable with a Cannot serve multipart range requests body instead of a generic unsatisfiable-range response (#661)
• fs: range error responses no longer carry representation headers such as Content-Type and Content-Encoding (#727)
• set-header: SetMultipleResponseHeadersLayer and SetMultipleResponseHeader are now Clone regardless of the response body type, matching the fix applied to the request-side types in 0.7.0 (#714)

#661: tower-rs/tower-http#661 #712: tower-rs/tower-http#712 #714: tower-rs/tower-http#714 #716: tower-rs/tower-http#716 #718: tower-rs/tower-http#718 #722: tower-rs/tower-http#722 #727: tower-rs/tower-http#727 #728: tower-rs/tower-http#728

All the changes

• chore(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in tower-rs/tower-http#708
• fix(compression): reject non-empty data frames after codec is EOF by @​seanmonstar in tower-rs/tower-http#712
• Remove Clone derivations from SetMultipleResponseHeader* types by @​skeet70 in tower-rs/tower-http#714
• feat(request-id): Allow request-id constructor in const context by @​tottoto in tower-rs/tower-http#716
• fs: Avoid unnecessary conversions between SystemTime and HttpDate by @​tottoto in tower-rs/tower-http#717
• fs: Use HeaderValue::is_empty to check for empty values by @​tottoto in tower-rs/tower-http#720
• fs: Use HeaderValue::to_str for date headers by @​tottoto in tower-rs/tower-http#721

... (truncated)

Commits

• c941451 chore(release): prepare 0.7.1 (#729)
• 9697702 chore(deps): bump taiki-e/install-action from 2.86.3 to 2.86.8 (#730)
• e2582e2 Allow ignoring multi-range requests (#727)
• 888f7fe feat(services): configure directory redirects (#728)
• 5ad7654 chore(deps): bump taiki-e/install-action from 2.85.12 to 2.86.3 (#726)
• d154adb fix: reject multipart ranges before validation (#661)
• d9e5c8a ci: Update to cargo-check-external-types 0.5.0 (#724)
• 90c072b Propagate ServeDir::try_call I/O errors (#718)
• 860922e fix(decompression): don't end the body on an empty data frame (#722)
• 8532252 docs(example)/custom future with multiple bodies (#711)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Thanks @dependabot[bot] for taking the time to contribute.

This repository is observing a maintainer-managed PR intake gate in dry-run mode, so this pull request is staying open. This note helps maintainers prepare the allowlist before any enforcement is considered.

Please read CONTRIBUTING.md for the expected contribution shape. A maintainer can grant recurring PR access by commenting /lgtm on a pull request.

[claude]

Claude finished @Hmbown's task in 46s —— View job

---

Reviewing dependabot PR: bump tower-http 0.7.0 → 0.7.1

• Gather context (PR diff, changelog, custom review instructions)
• Inspect Cargo.lock diff and check for any source usage of affected APIs
• Check for correctness/compat concerns from the changelog (behavioral changes)
• Post final review

Summary

Mechanical dependency bump — Cargo.lock only (tower-http 0.7.0 → 0.7.1), no application code touched.

Blast-radius check: the workspace pins tower-http = { version = "0.7", features = ["cors"] } (root Cargo.toml:74) and the only in-repo usage is tower_http::cors::CorsLayer in crates/tui/src/runtime_api.rs:41 and crates/app-server/src/lib.rs:31. None of the 0.7.1 changelog's behavioral changes apply to those code paths:

• fs (ServeDir/ServeFile I/O-error propagation, multipart-range rejection, redirect option) — not enabled/used.
• decompression (trailer/EOF handling fix) — not enabled/used.
• set-header (Clone bound fix) — not enabled/used.
• request-id (const fn) — not enabled/used.

So this upgrade carries no observable behavior change for Codewhale; it's a pure patch-level bump with no code impact.

Note: I wasn't able to run cargo check/cargo build in this sandbox (command required interactive approval that isn't available in this run), so I couldn't independently confirm a clean compile. Given the diff is purely a lockfile version/checksum bump with no Cargo.toml range change, and CI will run the full build/test matrix on this PR, that's low risk — but flagging per the capability limits so a maintainer can grant build permissions if a from-source confirmation is wanted.

No correctness, provider/model/route-safety, reuse, test-coverage, or security concerns identified.

[codewhale-agent]

Codewhale review

Dependabot bump of tower-http from 0.7.0 to 0.7.1 in Cargo.lock only. The new checksum matches the upstream release and the lockfile references are updated consistently.

Findings

• [INFO] Patch release includes a behavioral change in tower-http's fs module
  tower-http 0.7.1 changes ServeDir::try_call to propagate expected filesystem I/O errors when no fallback is configured instead of converting them to 404 responses. If this repository serves files with ServeDir and relies on the previous 404 behavior for I/O errors, this update could change responses.

Assessment

The lockfile update is correct and consistent. No blocking issues found; just verify whether the upstream fs behavior change affects any static file serving paths.

---

Advisory review by Codewhale (codewhale review --pr 5881 --post, head 5fc10058bc9d152d3999cd097f94a0f204eb6335). Line-specific findings are also posted as inline review comments; mechanical fixes arrive as committable suggestions you can apply from the Files tab. CODEOWNERS approval still governs merge.

[claude]

Claude finished @Hmbown's task in 32s —— View job

---

Reviewing dependabot PR: bump tower-http 0.7.0 → 0.7.1

• Gather context (PR diff, changelog, prior reviews)
• Inspect Cargo.lock diff and confirm only tower-http version/checksum changed
• Check in-repo usage of tower-http APIs against the 0.7.1 changelog's behavioral changes
• Post final review

Summary

This is a re-check after the branch was synced with main — the dependency diff itself is unchanged: Cargo.lock only (tower-http 0.7.0 → 0.7.1, checksum updated), no Cargo.toml range change, no application code touched.

Blast-radius check (confirmed): the workspace pins tower-http = { version = "0.7", features = ["cors"] } (Cargo.toml:74), and the only in-repo usage is tower_http::cors::CorsLayer in:

• crates/tui/src/runtime_api.rs:41
• crates/app-server/src/lib.rs:31

None of the 0.7.1 changelog's behavioral changes touch the cors module:

• fs (ServeDir/ServeFile I/O-error propagation, multipart-range rejection, redirect option) — not enabled/used.
• decompression (trailer/EOF handling fix) — not enabled/used.
• set-header (Clone bound fix) — not enabled/used.
• request-id (const fn) — not enabled/used.

This matches the earlier Codewhale automated review's advisory note (flagging the fs/ServeDir behavioral change as something to verify) — verified: this repo does not use ServeDir/ServeFile anywhere, so that change is inert here.

No correctness, provider/model/route-safety, reuse, test-coverage, or security concerns. Safe mechanical bump; CI's build/test matrix is the remaining gate before merge.

[codewhale-agent]

Codewhale review

Dependabot lockfile-only update bumping tower-http from 0.7.0 to 0.7.1. The diffs update the package version, checksum, and dependent package references consistently; no manifest or source changes are included.

Findings

• [INFO] Behavioral changes in tower-http 0.7.1 may affect existing error handling
  The release notes include behavioral fixes: fs::ServeDir::try_call now propagates expected filesystem I/O errors when no fallback is configured instead of converting them to 404 responses, and decompression now returns body errors after end-of-stream rather than silently truncating. If the application relies on the previous behavior, these changes may alter responses or surface errors. Verify affected code paths and tests.

Assessment

The lockfile update is minimal and internally consistent. No blocking issues found; just verify that the application does not depend on the changed tower-http error behaviors mentioned in the release notes.

---

Advisory review by Codewhale (codewhale review --pr 5881 --post, head 9a379882f48ba504871d145fd1fec225d864c783). Line-specific findings are also posted as inline review comments; mechanical fixes arrive as committable suggestions you can apply from the Files tab. CODEOWNERS approval still governs merge.