deps(deps): bump tower-http from 0.6.8 to 0.7.0

[dependabot]

Bumps tower-http from 0.6.8 to 0.7.0.

Release notes

Sourced from tower-http's releases.

tower-http-0.7.0

Changes since 0.6.11

Added

• csrf: add cross-site request forgery (CSRF) protection middleware, porting the cross-origin protection scheme introduced in Go 1.25 (#699)

  use tower::ServiceBuilder;
  use tower_http::csrf::CsrfLayer;
  // Rejects cross-origin state-changing requests using Sec-Fetch-Site,
  // an Origin allow-list, and an Origin/Host fallback. No per-request
  // token state required.
  let layer = CsrfLayer::new().add_trusted_origin("https://example.com")?;
  let service = ServiceBuilder::new().layer(layer).service_fn(handler);

• timeout: add DeadlineBody for non-resetting body timeouts, applied via the new RequestBodyDeadlineLayer and ResponseBodyDeadlineLayer (#688)

  Unlike TimeoutBody, which resets its deadline on every frame, DeadlineBody caps the total time of a body transfer. A slow client trickling one byte at a time never trips an idle timeout but will trip a deadline.

  use std::time::Duration;
  use tower::ServiceBuilder;
  use tower_http::timeout::RequestBodyDeadlineLayer;
  // Abort the request body transfer after 30s total, regardless of how
  // frequently data arrives.
  let service = ServiceBuilder::new()
  .layer(RequestBodyDeadlineLayer::new(Duration::from_secs(30)))
  .service_fn(handler);

• fs: add strong ETag support to ServeDir, including If-Match and If-None-Match precondition handling per RFC 9110. 304 Not Modified responses now carry the ETag and Last-Modified validators (#691)

• fs: add a Backend trait to make ServeDir work with non-filesystem sources (e.g. embedded assets or object storage). The default TokioBackend preserves existing behavior. Use ServeDir::with_backend() to plug in custom implementations (#684)

  use tower_http::services::fs::ServeDir;
  // MyBackend implements tower_http::services::fs::Backend.
  // The default ServeDir::new() continues to use TokioBackend (local FS).
  let service = ServeDir::with_backend("assets", MyBackend::new());

• fs: add html_as_default_extension option to ServeDir, appending .html when the request path has no extension (#519)

• fs: add redirect_path_prefix option to ServeDir, prepending a prefix on trailing-slash redirects so the service can be mounted under a sub-path (#486)

• validate-request: add ValidateRequestHeaderLayer::has_header_value() to reject requests when a header does not have an expected value (#360)

• body: UnsyncBoxBody::new() constructor and From<ServeFileSystemResponseBody> conversion to avoid double-boxing when combining ServeDir responses with other body types (#537)

• limit: implement Default for limit::ResponseBody when the wrapped body also implements Default (#679)

Changed

... (truncated)

Commits

• b194fcf v0.7.0
• af828a6 feat(follow_redirect)!: preserve request extensions across redirects (#706)
• 8cb8d99 feat(ValidateRequestHeaderLayer): add has_header("...").with_value("...") fun...
• 3b56d2d feat!: Add configurable Backend trait for ServeDir, bump MSRV 1.65 (#684)
• 8508716 Add redirect_path_prefix option (#486)
• 56327b2 Add Windows drive-prefix path regression test (#705)
• 54c6db8 feat(compression)!: upgrade SizeAbove threshold from u16 to u64 (#704)
• 68cd6d8 Add DeadlineBody for non-resetting body timeouts (#688)
• fa8a98c feat(fs): add strong ETag support to ServeDir (#691)
• 36d2205 fix: Make SetMultiple*Header Clone for !Clone http bodies (#703)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[cloudwalk-review-agent]

Summary

Dependency bump looks consistent and non-breaking within the provided diff scope:

• Cargo.toml updates tower-http from =0.6.8 to =0.7.0.
• Cargo.lock reflects expected resolver behavior with parallel versions (0.6.11 and 0.7.0) because other deps (notably reqwest) still require 0.6.x.
• No application/source code changes, migrations, auth/permission logic, or money-movement paths were modified.

No concrete correctness or security issue is evidenced by the provided changes alone.

[github-actions]

🧾 cargo-vet automated audit summary

• Vetted (auto-certified): 0

• Unvetted (needs manual review): 0

• Patch generated: yes

• Artifact uploaded: yes

• Artifact name: dependabot-auto-vet-patch-pr-2537

• Artifact ID: 7791767617

• PR number: 2537

• Run ID: 27951282990

• Retention: 90 days

• Artifact download: https://github.com/cloudwalk/stratus/actions/runs/27951282990/artifacts/7791767617

• cargo vet import updates: detected (no diffs required)

CI did not commit anything. Review the patch locally and create the final signed commit yourself.

Apply the patch locally

The patch artifact is attached to this workflow run as a zip archive. Download it, extract auto-vet.patch, review the result, then create your signed commit.

Preferred: GitHub CLI

git checkout <pr-branch>
gh run download 27951282990 -n dependabot-auto-vet-patch-pr-2537
git apply --index auto-vet.patch
git status
git commit -S -m "chore(vet): apply automated audits"
git push

Fallback: direct artifact download

git checkout <pr-branch>
curl -L \
  -H "Authorization: Bearer <github-token>" \
  -o auto-vet-artifact.zip \
  https://github.com/cloudwalk/stratus/actions/runs/27951282990/artifacts/7791767617
unzip -p auto-vet-artifact.zip vet/auto-vet.patch > auto-vet.patch
git apply --index auto-vet.patch
git status
git commit -S -m "chore(vet): apply automated audits"
git push

[cloudwalk-review-agent]

Summary

Dependency bump is consistent and low-risk within the provided diff.

• Cargo.toml pins tower-http from 0.6.8 to 0.7.0 with the same cors feature.
• Cargo.lock correctly reflects coexistence of tower-http 0.6.11 (still required transitively by reqwest) and tower-http 0.7.0 (direct dependency), avoiding resolver ambiguity.
• supply-chain/audits.toml adds explicit vet entries covering both 0.6.8 -> 0.6.11 and 0.6.8 -> 0.7.0.

No concrete correctness, security, or deploy-blocking issue is evidenced by these changes alone.

[cloudwalk-review-agent]

Summary

Dependency bump is internally consistent and low-risk in the provided diff.

• Cargo.toml updates direct dependency to tower-http = 0.7.0 (same cors feature).
• Cargo.lock correctly keeps both tower-http 0.6.11 (transitive via reqwest) and tower-http 0.7.0 (direct), with explicit version-qualified edges to avoid resolver ambiguity.
• Lockfile deltas are coherent with upstream changes (e.g., iri-string removal from the updated tower-http 0.6.11 package entry and the new 0.7.0 package node).
• supply-chain/audits.toml includes new vet entries for both 0.6.8 -> 0.6.11 and 0.6.8 -> 0.7.0 transitions.

No concrete correctness, security, or deploy-blocking issue is evidenced by these changes alone.

[cloudwalk-review-agent]

Summary

Dependency update is internally consistent and low risk within the provided diff:

• Cargo.toml bumps direct dependency to tower-http = 0.7.0 while keeping the same cors feature usage.
• Cargo.lock correctly resolves parallel tower-http versions (0.6.11 transitively via reqwest and 0.7.0 directly), with explicit version-qualified edges preventing ambiguity.
• Lockfile deltas are coherent with upstream package graph changes (e.g., iri-string removal from the 0.6.x node and addition of a separate 0.7.0 node).
• supply-chain/audits.toml includes explicit audit entries for both 0.6.8 -> 0.6.11 and 0.6.8 -> 0.7.0 transitions.

No concrete correctness, security, or deploy-blocking issue is evidenced by these changes alone.