fix(deps): bump jsonwebtoken to 10.4.0

[tobyhede]

Bumps jsonwebtoken to 10.4.0, pulled in transitively via stack-auth 0.42.2 (now depends on jsonwebtoken ^10.3.0 instead of the previous ^9.3.1 pin). No direct usage of jsonwebtoken in this repo — clean transitive bump, workspace builds successfully.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4ae0e6c6-a494-4214-862f-993093c610a4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[freshtonic]

Approving.

Verified the lock-only bump does what the description says:

• jsonwebtoken 9.3.1 → 10.4.0, arriving via stack-auth 0.42.2, which declares jsonwebtoken = "10.3.0" with default-features = false, features = ["aws_lc_rs", "use_pem"]. That swaps the crypto backend from ring to aws-lc-rs, which is the real substance of this diff — worth naming explicitly, since the PR body reads as a routine version-number bump.
• No Cargo.toml change is needed here: nothing in this workspace pins the 0.42.x crates exactly, so the lock moves on its own. Confirmed no direct jsonwebtoken usage.
• The backend swap adds no new build-toolchain burden. aws-lc-rs/aws-lc-sys are already in the lock on main (via rustls), so nothing new has to compile and no CMake/C requirement is introduced by this change.

One incidental change worth noting, not a blocker: winapi-util 0.1.11's windows-sys resolves 0.61.2 → 0.48.0. That's within its declared range (>=0.48.0, <=0.61.*, cfg(windows)-gated only), and it collapses a duplicate windows-sys copy rather than adding one — harmless, just unrelated to the stated change.

Full CI green, including the PG17 shards and the e2e property suite.

[coderdan]

That's a fairly substantive drop. Any idea why that's changed so much?

[coderdan]

Looks fine, but there's one dependency that downgraded by quite a lot. Maybe worth checking before merging.