chore(deps): add dependabot cooldowns, bump cargo and nuget deps

[klobucar]

What this changes

Adds Dependabot cooldown periods for the cargo, nuget, and github-actions ecosystems, and bumps dependencies in both: cargo update across the workspace, plus Avalonia (12.0.2→12.1.1), CommunityToolkit.Mvvm (8.3.2→8.4.2), Google.Protobuf (3.25.1→3.35.1), Grpc.Tools (2.62.0→2.83.0), and NSec.Cryptography (24.4.0→26.4.0) in the desktop client.

Why

Cooldowns delay automatic adoption of freshly-published dependency versions, cutting exposure to supply-chain attacks where a compromised release gets pulled in before it's caught. Bumping now clears the existing drift so the cooldown starts from a clean baseline.

How tested

cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings, and cargo test --workspace all pass. The NuGet version bumps were vetted with Socket's depscore before being applied (all clean on license/maintenance/quality/supply-chain/vulnerability). Not exercised end-to-end: clients/desktop currently fails to build for an unrelated, pre-existing reason (AuraNetworkClient.cs missing an epoch arg to MlsWrapper.ExportTextKey) that predates this branch.

Notes for the reviewer

sfw deterministically failed TLS chain validation against NuGet's repository-signature endpoints for 7 of the 8 package bumps (reproducible, not flaky). Those were applied via plain dotnet add package after independently vetting the target versions with Socket's depscore. Might be worth a bug report to Socket for the sfw/dotnet interaction.

Checklist

• Commit messages follow Conventional Commits
• Commits are signed off (git commit -s) per the DCO
• cargo fmt --all clean
• cargo clippy --workspace --all-targets -- -D warnings clean
• cargo test --workspace passes
• Wire-format / protocol changes have a corresponding update in docs/protocol.md — n/a, no wire changes
• Crypto changes have a corresponding update in docs/MLS_SECURITY.md or docs/05_dave_protocol_deviations.md — n/a, dependency version bump only, no algorithm/protocol changes

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​tokio@​1.52.1 ⏵ 1.53.1
	cargo/​thiserror@​2.0.18 ⏵ 2.0.20
	nuget/​communitytoolkit.mvvm@​8.3.2 ⏵ 8.4.2	-2
	nuget/​nsec.cryptography@​24.4.0 ⏵ 26.4.0	-1
	cargo/​anyhow@​1.0.102 ⏵ 1.0.104
	cargo/​serde@​1.0.228 ⏵ 1.0.229
	cargo/​rustls@​0.23.40 ⏵ 0.23.43
	cargo/​quinn@​0.11.9 ⏵ 0.11.11
	cargo/​serde_json@​1.0.149 ⏵ 1.0.151
	nuget/​avalonia@​12.0.2 ⏵ 12.1.1	+21		+11
	nuget/​google.protobuf@​3.25.1 ⏵ 3.35.1
	nuget/​grpc.tools@​2.62.0 ⏵ 2.83.0
	cargo/​bytes@​1.11.1 ⏵ 1.12.1
	cargo/​cc@​1.2.61 ⏵ 1.4.3
	cargo/​dashmap@​6.1.0 ⏵ 6.2.1
	cargo/​futures@​0.3.32 ⏵ 0.3.34
	cargo/​prost@​0.14.3 ⏵ 0.14.4
	cargo/​prost-build@​0.14.3 ⏵ 0.14.4
	cargo/​rand@​0.10.1 ⏵ 0.10.2
	cargo/​rcgen@​0.14.7 ⏵ 0.14.9
	cargo/​regex@​1.12.3 ⏵ 1.13.1
	cargo/​rustls-acme@​0.15.1 ⏵ 0.15.4
	cargo/​rustls-pki-types@​1.14.1 ⏵ 1.15.1
	cargo/​tokio-stream@​0.1.18 ⏵ 0.1.19
	cargo/​toml@​1.1.2%2Bspec-1.1.0 ⏵ 1.1.4+spec-1.1.0
	cargo/​uuid@​1.23.1 ⏵ 1.24.1
	cargo/​webrtc-audio-processing@​2.0.4 ⏵ 2.1.0
	cargo/​zeroize@​1.8.2 ⏵ 1.9.0
	nuget/​avalonia.fonts.inter@​12.0.2 ⏵ 12.1.1	+1		+11
	nuget/​avalonia.themes.fluent@​12.0.2 ⏵ 12.1.1	+1		+11
	nuget/​avalonia.desktop@​12.0.2 ⏵ 12.1.1	+1		+11

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: cargo tokio is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: Cargo.lock → cargo/tokio@1.53.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/tokio@1.53.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report