fix(toolchain): upgrade Rust to 1.98.1 and patch rustls

.github/workflows/release-audio.yml

@@ -42,10 +42,10 @@ jobs:
           cache: false
       - name: Install pinned native build tools
         run: |
-          mise --no-config install python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.97.0
-          test "$(mise --no-config exec python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.97.0 -- rustc --version | cut -d' ' -f2)" = 1.97.0
-          test "$(mise --no-config exec python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.97.0 -- cargo --version | cut -d' ' -f2)" = 1.97.0
-          test "$(mise --no-config exec python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.97.0 -- zig version)" = 0.13.0
+          mise --no-config install python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.98.1
+          test "$(mise --no-config exec python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.98.1 -- rustc --version | cut -d' ' -f2)" = 1.98.1
+          test "$(mise --no-config exec python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.98.1 -- cargo --version | cut -d' ' -f2)" = 1.98.1
+          test "$(mise --no-config exec python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.98.1 -- zig version)" = 0.13.0
       - id: contract
         name: Validate exact release identity and asset filename
         env:
@@ -56,12 +56,12 @@ jobs:
           set -euo pipefail
           test "$RELEASE_TAG" = "v$RELEASE_VERSION"
           test "$(git rev-parse HEAD)" = "$RELEASE_SHA"
-          filename="$(mise --no-config exec python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.97.0 -- python -c 'import runpy; print(runpy.run_path("packages/sie_audio_prep/build_wheel.py")["AUDIO_WHEEL_FILENAME"])')"
+          filename="$(mise --no-config exec python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.98.1 -- python -c 'import runpy; print(runpy.run_path("packages/sie_audio_prep/build_wheel.py")["AUDIO_WHEEL_FILENAME"])')"
           test "$filename" = "sie_audio_prep-$RELEASE_VERSION-cp312-abi3-manylinux_2_28_x86_64.whl"
           echo "filename=$filename" >> "$GITHUB_OUTPUT"
       - name: Build and validate exact Linux wheel
         run: >-
-          mise --no-config exec python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.97.0 --
+          mise --no-config exec python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.98.1 --
           python tools/ci/build_audio_prep_release_asset.py --out dist
       - name: Record exact tested wheel and original run provenance
         run: >-

mise.toml

@@ -4,7 +4,7 @@ experimental = true
 [tools]
 python = "3.12.12"
 uv = "0.5.31"
-rust = { version = "1.97.0", profile = "default", components = ["rustfmt", "clippy", "llvm-tools"] }
+rust = { version = "1.98.1", profile = "default", components = ["rustfmt", "clippy", "llvm-tools"] }
 "cargo:cargo-deny" = "0.20.2"
 "cargo:cargo-llvm-cov" = "0.8.7"
 node = ["24.12.0", "22.23.2"]

packages/sie_audio_prep/src/lib.rs

@@ -837,7 +837,9 @@ mod tests {
             decode_audio(wav_pcm16(16_000, 1, &frames), None, AudioLimits::default()).unwrap();
         let pcm = prepared.pcm_s16le();
         let reconstructed = pcm
-            .chunks_exact(2)
+            .as_chunks::<2>()
+            .0
+            .iter()
             .map(|bytes| f32::from(i16::from_le_bytes([bytes[0], bytes[1]])) / 32_768.0)
             .collect::<Vec<_>>();
         assert_eq!(reconstructed.len(), prepared.samples.len());

packages/sie_gateway/Dockerfile

@@ -1,4 +1,4 @@
-FROM rust:1.97.0-slim-bookworm@sha256:6d220bf85c74e842a79da63997af8d2e74455c0b8847d8bb3a5888572334991d AS chef
+FROM rust:1.98.1-slim-bookworm@sha256:ebd900bae66fd508b466cef82d64a83a5fb34682e4c8b2797a42908bddc95a57 AS chef
 RUN cargo install cargo-chef --locked
 WORKDIR /app
 

packages/sie_gateway/src/handlers/proxy.rs

@@ -12098,7 +12098,9 @@ fn decode_dtype_values(dtype: &str, data: &[u8]) -> Option<Vec<serde_json::Value
                 return None;
             }
             Some(
-                data.chunks_exact(4)
+                data.as_chunks::<4>()
+                    .0
+                    .iter()
                     .map(|chunk| {
                         let val = f32::from_le_bytes([chunk[0], chunk[1], chunk[2], chunk[3]]);
                         serde_json::Value::from(val as f64)
@@ -12111,7 +12113,9 @@ fn decode_dtype_values(dtype: &str, data: &[u8]) -> Option<Vec<serde_json::Value
                 return None;
             }
             Some(
-                data.chunks_exact(8)
+                data.as_chunks::<8>()
+                    .0
+                    .iter()
                     .map(|chunk| {
                         let val = f64::from_le_bytes([
                             chunk[0], chunk[1], chunk[2], chunk[3], chunk[4], chunk[5], chunk[6],
@@ -12127,7 +12131,9 @@ fn decode_dtype_values(dtype: &str, data: &[u8]) -> Option<Vec<serde_json::Value
                 return None;
             }
             Some(
-                data.chunks_exact(2)
+                data.as_chunks::<2>()
+                    .0
+                    .iter()
                     .map(|chunk| {
                         let bits = u16::from_le_bytes([chunk[0], chunk[1]]);
                         let val = f16_to_f32(bits);
@@ -12141,7 +12147,9 @@ fn decode_dtype_values(dtype: &str, data: &[u8]) -> Option<Vec<serde_json::Value
                 return None;
             }
             Some(
-                data.chunks_exact(4)
+                data.as_chunks::<4>()
+                    .0
+                    .iter()
                     .map(|chunk| {
                         let val = i32::from_le_bytes([chunk[0], chunk[1], chunk[2], chunk[3]]);
                         serde_json::Value::from(val as i64)
@@ -12154,7 +12162,9 @@ fn decode_dtype_values(dtype: &str, data: &[u8]) -> Option<Vec<serde_json::Value
                 return None;
             }
             Some(
-                data.chunks_exact(8)
+                data.as_chunks::<8>()
+                    .0
+                    .iter()
                     .map(|chunk| {
                         let val = i64::from_le_bytes([
                             chunk[0], chunk[1], chunk[2], chunk[3], chunk[4], chunk[5], chunk[6],
@@ -12170,7 +12180,9 @@ fn decode_dtype_values(dtype: &str, data: &[u8]) -> Option<Vec<serde_json::Value
                 return None;
             }
             Some(
-                data.chunks_exact(2)
+                data.as_chunks::<2>()
+                    .0
+                    .iter()
                     .map(|chunk| {
                         let val = i16::from_le_bytes([chunk[0], chunk[1]]);
                         serde_json::Value::from(val as i64)
@@ -12183,7 +12195,9 @@ fn decode_dtype_values(dtype: &str, data: &[u8]) -> Option<Vec<serde_json::Value
                 return None;
             }
             Some(
-                data.chunks_exact(4)
+                data.as_chunks::<4>()
+                    .0
+                    .iter()
                     .map(|chunk| {
                         let val = u32::from_le_bytes([chunk[0], chunk[1], chunk[2], chunk[3]]);
                         serde_json::Value::from(val as u64)
@@ -12196,7 +12210,9 @@ fn decode_dtype_values(dtype: &str, data: &[u8]) -> Option<Vec<serde_json::Value
                 return None;
             }
             Some(
-                data.chunks_exact(8)
+                data.as_chunks::<8>()
+                    .0
+                    .iter()
                     .map(|chunk| {
                         let val = u64::from_le_bytes([
                             chunk[0], chunk[1], chunk[2], chunk[3], chunk[4], chunk[5], chunk[6],

packages/sie_server_rust/Dockerfile

@@ -9,7 +9,7 @@
 # contract to the worker-sidecar. Native engines such as Candle run inside this
 # process rather than through a sibling Python adapter process.
 
-ARG RUST_VERSION=1.97.0
+ARG RUST_VERSION=1.98.1
 ARG CARGO_FEATURES=""
 
 FROM rust:${RUST_VERSION}-slim-bookworm AS chef

packages/sie_server_rust/Dockerfile.candle

@@ -10,7 +10,7 @@
 # by the sidecar for engine=candle pools.
 
 ARG CUDA_VERSION=12.4.1
-ARG RUST_VERSION=1.97.0
+ARG RUST_VERSION=1.98.1
 # Candle CUDA kernels cannot detect compute capability during Docker builds.
 # Local builds default to the currently supported L4 target, and releases publish
 # sie-server-rust:<version>-cuda12-sm89. Override for ad-hoc target GPUs when

packages/sie_server_sidecar/Dockerfile

@@ -25,12 +25,11 @@
 #   testing mount a socket path and set SIE_IPC_SOCKET_PATH accordingly.
 
 ARG FEATURES=cloud-storage
-ARG RUST_VERSION=1.97.0
 
 # =============================================================================
 # Dependency planner: capture the Cargo graph only.
 # =============================================================================
-FROM rust:${RUST_VERSION}-slim-bookworm@sha256:6d220bf85c74e842a79da63997af8d2e74455c0b8847d8bb3a5888572334991d AS chef
+FROM rust:1.98.1-slim-bookworm@sha256:ebd900bae66fd508b466cef82d64a83a5fb34682e4c8b2797a42908bddc95a57 AS chef
 RUN cargo install cargo-chef --locked --version 0.1.77
 WORKDIR /build
 

tools/ci/check_release_contract.py

@@ -504,16 +504,16 @@ def audio_release_errors() -> list[str]:
     if mise_tools.get("zig") != "0.13.0":
         errors.append("native audio release must pin Zig 0.13.0")
     rust = mise_tools.get("rust", {})
-    if not isinstance(rust, dict) or rust.get("version") != "1.97.0":
-        errors.append("native audio release must use the repository Rust 1.97.0 pin")
+    if not isinstance(rust, dict) or rust.get("version") != "1.98.1":
+        errors.append("native audio release must use the repository Rust 1.98.1 pin")
     workflow = (ROOT / ".github/workflows/release-audio.yml").read_text()
     required = (
         "ref: ${{ inputs.sha }}",
         AUDIO_MANYLINUX_IMAGE,
         "version: 2026.7.11",
-        "mise --no-config install python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.97.0",
-        "rust@1.97.0 -- rustc --version",
-        "rust@1.97.0 -- cargo --version",
+        "mise --no-config install python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.98.1",
+        "rust@1.98.1 -- rustc --version",
+        "rust@1.98.1 -- cargo --version",
         "python tools/ci/build_audio_prep_release_asset.py --out dist",
         expected_filename.replace(version, "$RELEASE_VERSION"),
         "tools/ci/upload_audio_prep_release_asset.bash",

tools/ci/tests/test_release_contract.py

@@ -239,9 +239,9 @@ def test_native_audio_builder_installs_exact_rust_and_never_clobbers() -> None:
     uploader = (contract.ROOT / "tools/ci/upload_native_release_asset.bash").read_text()
     assert contract.AUDIO_MANYLINUX_IMAGE in workflow
     assert "version: 2026.7.11" in workflow
-    assert "mise --no-config install python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.97.0" in workflow
-    assert "rust@1.97.0 -- rustc --version" in workflow
-    assert "rust@1.97.0 -- cargo --version" in workflow
+    assert "mise --no-config install python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.98.1" in workflow
+    assert "rust@1.98.1 -- rustc --version" in workflow
+    assert "rust@1.98.1 -- cargo --version" in workflow
     assert "--clobber" not in workflow
     assert "--clobber" not in uploader
     assert "sha256sum" in uploader