build(deps): bump shared-frontend from v3.0.33 to v3.0.39

[dependabot]

Bumps shared-frontend from v3.0.33 to v3.0.39.

Changelog

Sourced from shared-frontend's changelog.

[3.0.39] - 2026-07-23

Removed

• session_id::generate_session_id — moved to per-app backend/src/session_id.rs. Each app now uses getrandom directly, so a bug in the session-id path compromises only that app. The shared impl had 2 unit tests; the per-app impl preserves them.
• cookie_auth::{build_cookie, build_clear_cookie, cookie_should_be_secure} — moved to per-app backend/src/cookie_auth.rs. Each app's cookie name is now baked into the local module (e.g. BEAM_PIN, DEFEND_PIN, TODO_PIN, TRACE_PIN); apps no longer share a generic build_cookie(name, value, ...) API. The shared impl had 8 unit tests; the per-app impl preserves them.

Why

• A bug in shared session_id (e.g. an OsRng fallback that returns all zeros under some edge case) would have compromised every app at once. Per-app code limits blast radius.
• Each app tunes its own cookie semantics (clamp range, cookie name, SameSite policy); the shared signature was a leaky abstraction.

[3.0.38] - 2026-07-23and this project adheres to Semantic Versioning.

[Unreleased] - 2026-07-23

Changed

• Audit Wave: Org-wide consolidation of shared-assets usage. The shared crate (v3.0.34..v3.0.37) now hosts the workspace inheritance, the rate_limit::RateLimiter, session_id::generate_session_id, cookie_auth::{build_cookie, cookie_should_be_secure}, the shared Login component, app_error::AppError, and auth::origin_check::{origin_matches, forbidden_response, ...}. The web apps' duplicated auth helpers, config, types, security headers, CSS, and bin/sh/tui.rs shells have been removed in favour of the shared implementations.
• Pre-wave: Removed the per-app interactive TUI admin console in favour of the existing CUI subcommands.
• Per-app refactor: file size cap enforcement (≤ 250 LoC/.rs) applied where the audit flagged oversize files.

[3.0.36] - 2026-07-23

Added

• shared_backend::app_error::AppError — generic axum::IntoResponse error envelope covering I/O, JSON, and catch-all internal cases. Replaces the byte-identical error.rs files in defend/scan/snake (97 LoC each). Apps wrap this with their own #[error("...")] variants.
• shared_backend::cookie_auth::cookie_should_be_secure — pure

... (truncated)

Commits

• d9d716b feat(shared-assets): remove session_id + cookie_auth modules (de-merge)
• 2a4bd99 docs(changelog): document shared-assets consolidation (Waves A-H)
• 46ed34c docs(readme): drop Native Package Manager + Unraid NAS sections (repos retired)
• 5af127c feat(shared-assets): add app_error, cookie_should_be_secure, origin_check hel...
• 24d4c8d feat(shared-assets): promote RateLimiter, session_id, cookie_auth, Login to s...
• 839f051 refactor(shared-assets): infrastructure hardening v3.0.34
• f3f7e14 chore: remove unused corgi-footer asset
• 5dcc586 docs: remove corgi footer image from README
• 249845a style(branding): update footer banner with 2D cel art anime female corgi in d...
• 6fd3727 style(branding): update footer picture bar with cute corgi illustration
• Additional commits viewable in compare view

[dependabot]

Looks like shared-frontend is up-to-date now, so this is no longer needed.