Small majors batch: dirs 7, sha2 0.11, scip 0.10, sysinfo 0.39; remove dead tower/tower-http

CHANGELOG.md

@@ -42,6 +42,8 @@ finalized in place with a date — no renaming/migration step needed.
 
 - **tree-sitter 0.26 → 0.27, tree-sitter-proto 0.4 → 0.6.** Zero call-site changes — the chunker sits on the stable `Parser`/`Language` surface and grammars load through the ABI-stable `LANGUAGE.into()` (`tree-sitter-language`) route, so all 17 grammar crates stay pinned while the core moves a major.
 
+- **Small majors batch: dirs 7, sha2 0.11, scip 0.10, sysinfo 0.39; dead `tower`/`tower-http` direct deps removed.** dirs/scip/sysinfo were drop-in. sha2 0.11's digest arrays no longer implement `LowerHex`, so the two hash-to-hex sites (`file_meta.rs`, `chunker/mod.rs`) hex-encode the digest bytes explicitly — output unchanged. `tower` and `tower-http` were declared as direct dependencies but never imported anywhere (CORS/trace middleware never wired in); removing them shrinks the direct dependency surface (both remain in the lock transitively via axum/reqwest/hf-hub, which is upstream's business).
+
 ## [1.3.19]
 
 ### Changed

Cargo.toml

@@ -72,8 +72,6 @@ regex = "1.12"
 
 # Server
 axum = "0.8"
-tower = "0.5"
-tower-http = { version = "0.6", features = ["cors", "trace"] }
 
 # TUI
 ratatui = "0.30"
@@ -87,12 +85,12 @@ serde_json = "1.0"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
 tracing-appender = "0.2"
-sha2 = "0.10"
+sha2 = "0.11"
 uuid = { version = "1.11", features = ["v4", "serde"] }
 chrono = { version = "0.4", features = ["serde"] }
 colored = "2.1"
 indicatif = "0.17"
-dirs = "5.0"
+dirs = "7"
 num_cpus = "1.16"
 async-trait = "0.1"
 # Vector database
@@ -101,7 +99,7 @@ heed = "0.22"
 bincode = "1.3"
 # SCIP symbol indexing — parses standard SCIP protobuf (.scip) emitted by
 # Sourcegraph indexers (e.g. scip-typescript) for the TypeScript symbol adapter.
-scip = "0.9"
+scip = "0.10"
 protobuf = "3.7"
 rand = "0.10"
 # Aikido 34247111: 1.8.0 carries 5 advisories (CVE-2026-64684/317735/617985 + 2 more).
@@ -110,7 +108,7 @@ rand = "0.10"
 rmcp = { version = "3.3.0", features = ["server", "client", "transport-io", "transport-streamable-http-server", "transport-streamable-http-client-reqwest", "macros"] }
 schemars = { version = "1.1.0", features = ["derive"] }
 reqwest = { version = "0.13", default-features = false, features = ["json", "rustls"] }
-sysinfo = { version = "0.38.4", default-features = true }
+sysinfo = { version = "0.39", default-features = true }
 
 [target.'cfg(unix)'.dependencies]
 libc = "0.2"

src/cache/file_meta.rs

@@ -343,7 +343,12 @@ impl FileMetaStore {
         let content = fs::read(path)?;
         let mut hasher = Sha256::new();
         hasher.update(&content);
-        Ok(format!("{:x}", hasher.finalize()))
+        // sha2 0.11: the digest array no longer impls LowerHex — hex-encode manually
+        Ok(hasher
+            .finalize()
+            .iter()
+            .map(|b| format!("{b:02x}"))
+            .collect())
     }
 
     /// Get file modification time as unix timestamp

src/chunker/mod.rs

@@ -94,7 +94,12 @@ impl Chunk {
     pub fn compute_hash(content: &str) -> String {
         let mut hasher = Sha256::new();
         hasher.update(content.as_bytes());
-        format!("{:x}", hasher.finalize())
+        // sha2 0.11: the digest array no longer impls LowerHex — hex-encode manually
+        hasher
+            .finalize()
+            .iter()
+            .map(|b| format!("{b:02x}"))
+            .collect::<String>()
     }
 
     /// TEST METHOD: Estimate memory usage of this chunk in bytes