diff --git a/Cargo.lock b/Cargo.lock
index 4966ad80c7e..10e2521bea8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -65,7 +65,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e01ed3140b2f8d422c68afa1ed2e85d996ea619c988ac834d255db32138655cb"
 dependencies = [
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -182,7 +182,7 @@ dependencies = [
  "actix-router",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -309,9 +309,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.94"
+version = "1.0.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1fd03a028ef38ba2276dce7e33fcd6369c158a1bca17946c4b1b701891c1ff7"
+checksum = "34ac096ce696dc2fcabef30516bb13c0a68a11d30131d3df6f04711467681b04"
 
 [[package]]
 name = "apple-codesign"
@@ -358,7 +358,7 @@ dependencies = [
  "reqwest 0.11.27",
  "ring",
  "scroll",
- "semver 1.0.23",
+ "semver 1.0.24",
  "serde",
  "serde_json",
  "serde_yaml",
@@ -440,7 +440,7 @@ checksum = "965c2d33e53cb6b267e148a4cb0760bc01f4904c1cd4bb4002a085bb016d1490"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
  "synstructure 0.13.1",
 ]
 
@@ -463,7 +463,7 @@ checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -478,9 +478,9 @@ dependencies = [
 
 [[package]]
 name = "async-broadcast"
-version = "0.7.1"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20cd0e2e25ea8e5f7e9df04578dc6cf5c83577fd09b1a46aaf5c85e1c33f2a7e"
+checksum = "435a87a52755b8f27fcf321ac4f04b2802e337c8c4872923137471ec39c37532"
 dependencies = [
  "event-listener",
  "event-listener-strategy",
@@ -508,7 +508,7 @@ checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -540,7 +540,7 @@ checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -557,7 +557,7 @@ checksum = "721cae7de5c34fbb2acd27e21e6d2cf7b886dce0c27388d46c4e6c47ea4318dd"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -583,9 +583,9 @@ checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
 
 [[package]]
 name = "aws-config"
-version = "1.5.10"
+version = "1.5.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b49afaa341e8dd8577e1a2200468f98956d6eda50bcf4a53246cc00174ba924"
+checksum = "a5d1c2c88936a73c699225d0bc00684a534166b0cebc2659c3cdf08de8edc64c"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
@@ -594,7 +594,7 @@ dependencies = [
  "aws-sdk-sts",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json 0.60.7",
+ "aws-smithy-json",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
@@ -625,9 +625,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.11.1"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f47bb8cc16b669d267eeccf585aea077d0882f4777b1c1f740217885d6e6e5a3"
+checksum = "f409eb70b561706bf8abba8ca9c112729c481595893fd06a2dd9af8ed8441148"
 dependencies = [
  "aws-lc-sys",
  "paste",
@@ -636,9 +636,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.23.1"
+version = "0.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2101df3813227bbaaaa0b04cd61c534c7954b22bd68d399b440be937dc63ff7"
+checksum = "8478a5c29ead3f3be14aff8a202ad965cf7da6856860041bfca271becf8ba48b"
 dependencies = [
  "bindgen",
  "cc",
@@ -651,9 +651,9 @@ dependencies = [
 
 [[package]]
 name = "aws-runtime"
-version = "1.4.4"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5ac934720fbb46206292d2c75b57e67acfc56fe7dfd34fb9a02334af08409ea"
+checksum = "300a12520b4e6d08b73f77680f12c16e8ae43250d55100e0b2be46d78da16a48"
 dependencies = [
  "aws-credential-types",
  "aws-sigv4",
@@ -676,15 +676,15 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-sqs"
-version = "1.50.0"
+version = "1.51.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d0a1bb53c15b172e67d1ed2576514a998397f91205c475e3278125a98134732"
+checksum = "5b423e56f794969e3912c4f763212d614b49e37758cb08dd250d13d3dad66e92"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json 0.61.1",
+ "aws-smithy-json",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
@@ -698,15 +698,15 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-sso"
-version = "1.50.0"
+version = "1.51.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05ca43a4ef210894f93096039ef1d6fa4ad3edfabb3be92b80908b9f2e4b4eab"
+checksum = "74995133da38f109a0eb8e8c886f9e80c713b6e9f2e6e5a6a1ba4450ce2ffc46"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json 0.61.1",
+ "aws-smithy-json",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
@@ -720,15 +720,15 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-ssooidc"
-version = "1.51.0"
+version = "1.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abaf490c2e48eed0bb8e2da2fb08405647bd7f253996e0f93b981958ea0f73b0"
+checksum = "e7062a779685cbf3b2401eb36151e2c6589fd5f3569b8a6bc2d199e5aaa1d059"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json 0.61.1",
+ "aws-smithy-json",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
@@ -742,15 +742,15 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-sts"
-version = "1.51.0"
+version = "1.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b68fde0d69c8bfdc1060ea7da21df3e39f6014da316783336deff0a9ec28f4bf"
+checksum = "299dae7b1dc0ee50434453fa5a229dc4b22bd3ee50409ff16becf1f7346e0193"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json 0.61.1",
+ "aws-smithy-json",
  "aws-smithy-query",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
@@ -788,9 +788,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-async"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62220bc6e97f946ddd51b5f1361f78996e704677afc518a4ff66b7a72ea1378c"
+checksum = "8aa8ff1492fd9fb99ae28e8467af0dbbb7c31512b16fabf1a0f10d7bb6ef78bb"
 dependencies = [
  "futures-util",
  "pin-project-lite",
@@ -817,15 +817,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "aws-smithy-json"
-version = "0.60.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4683df9469ef09468dad3473d129960119a0d3593617542b7d52086c8486f2d6"
-dependencies = [
- "aws-smithy-types",
-]
-
 [[package]]
 name = "aws-smithy-json"
 version = "0.61.1"
@@ -847,9 +838,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-runtime"
-version = "1.7.4"
+version = "1.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f20685047ca9d6f17b994a07f629c813f08b5bce65523e47124879e60103d45"
+checksum = "431a10d0e07e09091284ef04453dae4069283aa108d209974d67e77ae1caa658"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-http",
@@ -862,7 +853,7 @@ dependencies = [
  "http-body 0.4.6",
  "http-body 1.0.1",
  "httparse",
- "hyper 0.14.31",
+ "hyper 0.14.32",
  "hyper-rustls 0.24.2",
  "once_cell",
  "pin-project-lite",
@@ -891,9 +882,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-types"
-version = "1.2.9"
+version = "1.2.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fbd94a32b3a7d55d3806fe27d98d3ad393050439dd05eb53ece36ec5e3d3510"
+checksum = "8ecbf4d5dfb169812e2b240a4350f15ad3c6b03a54074e5712818801615f2dc5"
 dependencies = [
  "base64-simd",
  "bytes",
@@ -953,7 +944,7 @@ dependencies = [
  "http 1.2.0",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "itoa",
  "matchit",
@@ -970,7 +961,7 @@ dependencies = [
  "sync_wrapper 1.0.2",
  "tokio",
  "tokio-tungstenite",
- "tower 0.5.1",
+ "tower 0.5.2",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -1005,26 +996,7 @@ checksum = "57d123550fa8d071b7255cb0cc04dc302baa6c8c4a79f55701552684d8399bce"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
-]
-
-[[package]]
-name = "axum-server"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56bac90848f6a9393ac03c63c640925c4b7c8ca21654de40d53f55964667c7d8"
-dependencies = [
- "bytes",
- "futures-util",
- "http 1.2.0",
- "http-body 1.0.1",
- "http-body-util",
- "hyper 1.5.1",
- "hyper-util",
- "pin-project-lite",
- "tokio",
- "tower 0.4.13",
- "tower-service",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -1048,7 +1020,7 @@ dependencies = [
  "cfg-if",
  "libc",
  "miniz_oxide",
- "object 0.36.5",
+ "object 0.36.7",
  "rustc-demangle",
  "windows-targets 0.52.6",
 ]
@@ -1150,7 +1122,7 @@ dependencies = [
  "regex",
  "rustc-hash 1.1.0",
  "shlex",
- "syn 2.0.90",
+ "syn 2.0.91",
  "which 4.4.2",
 ]
 
@@ -1248,7 +1220,7 @@ dependencies = [
  "hex",
  "http 1.2.0",
  "http-body-util",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-named-pipe",
  "hyper-util",
  "hyperlocal",
@@ -1259,7 +1231,7 @@ dependencies = [
  "serde_json",
  "serde_repr",
  "serde_urlencoded",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tokio-util",
  "tower-service",
@@ -1310,9 +1282,9 @@ dependencies = [
 
 [[package]]
 name = "bstr"
-version = "1.11.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a68f1f47cdf0ec8ee4b941b2eee2a80cb796db73118c0dd09ac63fbe405be22"
+checksum = "786a307d683a5bf92e6fd5fd69a7eb613751668d1d8d67d802846dfe367c62c8"
 dependencies = [
  "memchr",
  "serde",
@@ -1337,9 +1309,9 @@ dependencies = [
 
 [[package]]
 name = "bytemuck"
-version = "1.20.0"
+version = "1.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b37c88a63ffd85d15b406896cc343916d7cf57838a847b3a6f2ca5d39a5695a"
+checksum = "ef657dfab802224e671f5818e9a4935f9b1957ed18e58292690cc39e7a4092a3"
 
 [[package]]
 name = "byteorder"
@@ -1421,9 +1393,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.2"
+version = "1.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f34d93e62b03caf570cccc334cbc6c2fceca82f39211051345108adcba3eebdc"
+checksum = "c31a0499c1dc64f458ad13872de75c0eb7e3fdb0e67964610c914b034fc5956e"
 dependencies = [
  "jobserver",
  "libc",
@@ -1453,9 +1425,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "chrono"
-version = "0.4.38"
+version = "0.4.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
+checksum = "7e36cc9d416881d2e24f9a963be5fb1cd90966419ac844274161d10488b3e825"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
@@ -1533,9 +1505,9 @@ dependencies = [
 
 [[package]]
 name = "clap_complete"
-version = "4.5.38"
+version = "4.5.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9647a559c112175f17cf724dc72d3645680a883c58481332779192b0d8e7a01"
+checksum = "ac2e663e3e3bed2d32d065a8404024dad306e699a04263ec59919529f803aee9"
 dependencies = [
  "clap",
 ]
@@ -1549,7 +1521,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -1584,15 +1556,15 @@ dependencies = [
 
 [[package]]
 name = "console"
-version = "0.15.8"
+version = "0.15.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e1f83fc076bd6dd27517eacdf25fef6c4dfe5f1d7448bafaaf3a26f13b5e4eb"
+checksum = "ea3c6ecd8059b57859df5c69830340ed3c41d30e3da0c1cbed90a96ac853041b"
 dependencies = [
- "encode_unicode 0.3.6",
- "lazy_static",
+ "encode_unicode",
  "libc",
- "unicode-width 0.1.14",
- "windows-sys 0.52.0",
+ "once_cell",
+ "unicode-width 0.2.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -1623,9 +1595,9 @@ dependencies = [
 
 [[package]]
 name = "const_panic"
-version = "0.2.10"
+version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "013b6c2c3a14d678f38cd23994b02da3a1a1b6a5d1eedddfe63a5a5f11b13a81"
+checksum = "53857514f72ee4a2b583de67401e3ff63a5472ca4acf289d09a9ea7636dfec17"
 
 [[package]]
 name = "containerd-client"
@@ -1715,18 +1687,18 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.13"
+version = "0.5.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33480d6946193aa8033910124896ca395333cae7e2d1113d1fef6c3272217df2"
+checksum = "06ba6d68e24814cb8de6bb986db8222d3a027d15872cabc0d18817bc3c0e4471"
 dependencies = [
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-deque"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613f8cc01fe9cf1a3eb3d7f488fd2fa8388403e97039e2f73692932e291a770d"
+checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51"
 dependencies = [
  "crossbeam-epoch",
  "crossbeam-utils",
@@ -1743,9 +1715,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.20"
+version = "0.8.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
 [[package]]
 name = "crunchy"
@@ -1830,7 +1802,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a2785755761f3ddc1492979ce1e48d2c00d09311c39e4466429188f3dd6501"
 dependencies = [
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -1862,7 +1834,7 @@ checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -1886,7 +1858,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -1897,7 +1869,7 @@ checksum = "d336a2a514f6ccccaa3e09b02d41d35330c07ddf03a62165fcec10bb561c7806"
 dependencies = [
  "darling_core",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -1973,7 +1945,7 @@ dependencies = [
  "darling",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -1983,7 +1955,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c"
 dependencies = [
  "derive_builder_core",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -1996,7 +1968,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustc_version",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -2095,7 +2067,7 @@ checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -2157,7 +2129,7 @@ dependencies = [
  "enum-ordinalize",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -2185,12 +2157,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "encode_unicode"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a357d28ed41a50f9c765dbfe56cbc04a64e53e5fc58ba79fbc34c10ef3df831f"
-
 [[package]]
 name = "encode_unicode"
 version = "1.0.0"
@@ -2215,7 +2181,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -2235,7 +2201,7 @@ checksum = "0d28318a75d4aead5c4db25382e8ef717932d0346600cacae6357eb5941bc5ff"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -2247,19 +2213,25 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
 name = "env_filter"
-version = "0.1.2"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f2c92ceda6ceec50f43169f9ee8424fe2db276791afde7b2cd8bc084cb376ab"
+checksum = "186e05a59d4c50738528153b83b0b0194d3a29507dfec16eccd4b342903397d0"
 dependencies = [
  "log",
  "regex",
 ]
 
+[[package]]
+name = "env_home"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f84e12ccf0a7ddc17a6c41c93326024c42920d7ee630d04950e6926645c0fe"
+
 [[package]]
 name = "env_logger"
 version = "0.10.2"
@@ -2275,9 +2247,9 @@ dependencies = [
 
 [[package]]
 name = "env_logger"
-version = "0.11.5"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13fa619b91fb2381732789fc5de83b45675e882f66623b7d8cb4f643017018d"
+checksum = "dcaee3d8e3cfc3fd92428d477bc97fc29ec8716d180c0d74c643bb26166660e0"
 dependencies = [
  "anstream",
  "anstyle",
@@ -2405,9 +2377,9 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "486f806e73c5707928240ddc295403b1b93c96a02038563881c4a2fd84b81ac4"
+checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
 
 [[package]]
 name = "ff"
@@ -2464,27 +2436,6 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
 
-[[package]]
-name = "flaky_test"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "046caa1f23d7f751fc4ead3d6669a77fa5fc6cf6074960ddeb6a0b0a5b83c8da"
-dependencies = [
- "flaky_test_impl",
- "futures-util",
-]
-
-[[package]]
-name = "flaky_test_impl"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85e35909c2f0552fdae5b40f1e95a7da12afb58c1f2f455a12c216c58d869abe"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
 [[package]]
 name = "flate2"
 version = "1.0.35"
@@ -2503,9 +2454,9 @@ checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
 [[package]]
 name = "foldhash"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f81ec6369c545a7d40e4589b5597581fa1c441fe1cce96dd1de43159910a36a2"
+checksum = "a0d2fde1f7b3d48b8395d5f2de76c18a528bd6a9cdde438df747bfcba3e05d6f"
 
 [[package]]
 name = "form_urlencoded"
@@ -2647,7 +2598,7 @@ checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -2719,7 +2670,7 @@ dependencies = [
  "proc-macro-error2",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -2911,7 +2862,7 @@ dependencies = [
  "once_cell",
  "rand",
  "serde",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tinyvec",
  "tokio",
  "tracing",
@@ -2935,7 +2886,7 @@ dependencies = [
  "resolv-conf",
  "serde",
  "smallvec",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tracing",
 ]
@@ -2960,17 +2911,17 @@ dependencies = [
 
 [[package]]
 name = "hmac-sha256"
-version = "1.1.7"
+version = "1.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3688e69b38018fec1557254f64c8dc2cc8ec502890182f395dbb0aa997aa5735"
+checksum = "4a8575493d277c9092b988c780c94737fb9fd8651a1001e16bee3eccfc1baedb"
 
 [[package]]
 name = "home"
-version = "0.5.9"
+version = "0.5.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3d1354bf6b7235cb4a0576c2619fd4ed18183f689b12b006a0ee7329eeff9a5"
+checksum = "589533453244b0995c858700322199b2becb13b627df2851f64a2775d024abcf"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -3079,9 +3030,9 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 
 [[package]]
 name = "hyper"
-version = "0.14.31"
+version = "0.14.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c08302e8fa335b151b788c775ff56e7a03ae64ff85c548ee820fecb70356e85"
+checksum = "41dfc780fdec9373c01bae43289ea34c972e40ee3c9f6b3c8801a35f35586ce7"
 dependencies = [
  "bytes",
  "futures-channel",
@@ -3103,9 +3054,9 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.5.1"
+version = "1.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97818827ef4f364230e16705d4706e2897df2bb60617d6ca15d598025a3c481f"
+checksum = "256fb8d4bd6413123cc9d91832d78325c48ff41677595be797d90f42969beae0"
 dependencies = [
  "bytes",
  "futures-channel",
@@ -3132,8 +3083,8 @@ dependencies = [
  "futures-util",
  "headers",
  "http 1.2.0",
- "hyper 1.5.1",
- "hyper-rustls 0.27.3",
+ "hyper 1.5.2",
+ "hyper-rustls 0.27.5",
  "hyper-util",
  "pin-project-lite",
  "rustls-native-certs 0.7.3",
@@ -3149,7 +3100,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73b7d8abf35697b81a825e386fc151e0d503e8cb5fcb93cc8669c376dfd6f278"
 dependencies = [
  "hex",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -3165,7 +3116,7 @@ checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
 dependencies = [
  "futures-util",
  "http 0.2.12",
- "hyper 0.14.31",
+ "hyper 0.14.32",
  "log",
  "rustls 0.21.12",
  "rustls-native-certs 0.6.3",
@@ -3175,16 +3126,16 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.27.3"
+version = "0.27.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08afdbb5c31130e3034af566421053ab03787c640246a446327f550d11bcb333"
+checksum = "2d191583f3da1305256f22463b9bb0471acad48a4e534a5218b9963e9c1f59b2"
 dependencies = [
  "futures-util",
  "http 1.2.0",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "log",
- "rustls 0.23.19",
+ "rustls 0.23.20",
  "rustls-native-certs 0.8.1",
  "rustls-pki-types",
  "tokio",
@@ -3201,7 +3152,7 @@ checksum = "51c227614c208f7e7c2e040526912604a1a957fe467c9c2f5b06c5d032337dab"
 dependencies = [
  "async-socks5",
  "http 1.2.0",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "thiserror 1.0.69",
  "tokio",
@@ -3214,7 +3165,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
 dependencies = [
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -3232,7 +3183,7 @@ dependencies = [
  "futures-util",
  "http 1.2.0",
  "http-body 1.0.1",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "pin-project-lite",
  "socket2",
  "tokio",
@@ -3248,7 +3199,7 @@ checksum = "986c5ce3b994526b3cd75578e62554abd09f0899d6206de48b3e96ab34ccc8c7"
 dependencies = [
  "hex",
  "http-body-util",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -3393,7 +3344,7 @@ checksum = "1ec89e9337638ecdc08744df490b221a7399bf8d164eb52a665454e60e075ad6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -3441,9 +3392,9 @@ dependencies = [
 
 [[package]]
 name = "impl-more"
-version = "0.1.8"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aae21c3177a27788957044151cc2800043d127acaa460a47ebb9b84dfa2c6aa0"
+checksum = "e8a5a9a0ff0086c7a148acb942baaabeadf9504d10400b5a05645853729b9cd2"
 
 [[package]]
 name = "indexmap"
@@ -3570,7 +3521,7 @@ name = "issue1317"
 version = "3.128.0"
 dependencies = [
  "actix-web",
- "env_logger 0.11.5",
+ "env_logger 0.11.6",
  "tokio",
  "tracing",
 ]
@@ -3657,9 +3608,9 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.74"
+version = "0.3.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a865e038f7f6ed956f788f0d7d60c541fff74c7bd74272c5d4cf15c63743e705"
+checksum = "6717b6b5b077764fb5966237269cb3c64edddde4b14ce42647430a78ced9e7b7"
 dependencies = [
  "once_cell",
  "wasm-bindgen",
@@ -3781,9 +3732,9 @@ dependencies = [
  "http 1.2.0",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-http-proxy",
- "hyper-rustls 0.27.3",
+ "hyper-rustls 0.27.5",
  "hyper-socks2",
  "hyper-timeout",
  "hyper-util",
@@ -3792,7 +3743,7 @@ dependencies = [
  "kube-core",
  "pem",
  "rand",
- "rustls 0.23.19",
+ "rustls 0.23.20",
  "rustls-pemfile 2.2.0",
  "secrecy",
  "serde",
@@ -3802,7 +3753,7 @@ dependencies = [
  "tokio",
  "tokio-tungstenite",
  "tokio-util",
- "tower 0.5.1",
+ "tower 0.5.2",
  "tower-http",
  "tracing",
 ]
@@ -3833,7 +3784,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "serde_json",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -3883,9 +3834,9 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
 [[package]]
 name = "libc"
-version = "0.2.167"
+version = "0.2.169"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09d6582e104315a817dff97f75133544b2e094ee22447d2acf4a74e189ba06fc"
+checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
 
 [[package]]
 name = "libloading"
@@ -4024,8 +3975,8 @@ dependencies = [
  "clap",
  "glob",
  "rand",
- "syn 2.0.90",
- "thiserror 2.0.4",
+ "syn 2.0.91",
+ "thiserror 2.0.9",
  "tracing",
  "tracing-subscriber",
 ]
@@ -4092,7 +4043,7 @@ checksum = "23c9b935fbe1d6cbd1dac857b54a688145e2d93f48db36010514d0f612d0ad67"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -4129,9 +4080,9 @@ checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.8.0"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2d80299ef12ff69b16a84bb182e3b9df68b5a91574d3d4fa6e41b65deec4df1"
+checksum = "4ffbe83022cedc1d264172192511ae958937694cd57ce297164951b8b3568394"
 dependencies = [
  "adler2",
 ]
@@ -4158,12 +4109,10 @@ dependencies = [
  "const-random",
  "drain",
  "envfile",
- "exec",
  "futures",
- "http-body 1.0.1",
  "http-body-util",
  "humantime",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "k8s-openapi",
  "kube",
@@ -4189,23 +4138,21 @@ dependencies = [
  "regex",
  "reqwest 0.12.9",
  "rstest",
- "rustls 0.23.19",
+ "rustls 0.23.20",
  "rustls-pemfile 2.2.0",
- "semver 1.0.23",
+ "semver 1.0.24",
  "serde",
  "serde_json",
  "socket2",
  "tempfile",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
- "tokio-retry",
  "tokio-rustls 0.26.1",
  "tokio-stream",
  "tokio-util",
  "tracing",
  "tracing-subscriber",
- "tun2",
- "which 7.0.0",
+ "which 7.0.1",
 ]
 
 [[package]]
@@ -4215,7 +4162,6 @@ dependencies = [
  "actix-codec",
  "async-trait",
  "axum",
- "axum-server",
  "bollard",
  "bytes",
  "clap",
@@ -4230,7 +4176,7 @@ dependencies = [
  "http 1.2.0",
  "http-body-util",
  "httparse",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "iptables",
  "k8s-cri",
@@ -4245,23 +4191,22 @@ dependencies = [
  "rand",
  "rawsocket",
  "rcgen",
- "regex",
  "reqwest 0.12.9",
  "rstest",
- "rustls 0.23.19",
- "semver 1.0.23",
+ "rustls 0.23.20",
+ "semver 1.0.24",
  "serde",
  "serde_json",
  "socket2",
  "streammap-ext",
  "test_bin",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tokio-rustls 0.26.1",
  "tokio-stream",
  "tokio-util",
  "tonic",
- "tower 0.5.1",
+ "tower 0.5.2",
  "tracing",
  "tracing-subscriber",
  "wildmatch",
@@ -4296,7 +4241,7 @@ dependencies = [
  "reqwest 0.12.9",
  "serde",
  "serde_yaml",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tracing",
  "whoami",
@@ -4321,7 +4266,7 @@ dependencies = [
  "serde_json",
  "serde_yaml",
  "tera",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "toml 0.8.19",
  "tracing",
 ]
@@ -4333,7 +4278,7 @@ dependencies = [
  "proc-macro2",
  "proc-macro2-diagnostics",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -4345,7 +4290,7 @@ dependencies = [
  "log",
  "miette",
  "mirrord-intproxy-protocol",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tokio-util",
  "tracing",
@@ -4361,7 +4306,7 @@ dependencies = [
  "futures",
  "h2 0.4.7",
  "http-body-util",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "mirrord-analytics",
  "mirrord-config",
@@ -4372,11 +4317,11 @@ dependencies = [
  "rand",
  "reqwest 0.12.9",
  "rstest",
- "rustls 0.23.19",
+ "rustls 0.23.20",
  "rustls-pemfile 2.2.0",
- "semver 1.0.23",
+ "semver 1.0.24",
  "serde",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tokio-rustls 0.26.1",
  "tokio-stream",
@@ -4389,7 +4334,7 @@ version = "3.128.0"
 dependencies = [
  "bincode",
  "mirrord-protocol",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
 ]
 
@@ -4399,27 +4344,21 @@ version = "3.128.0"
 dependencies = [
  "actix-codec",
  "async-stream",
- "base64 0.22.1",
- "bytes",
  "futures",
- "http-body 1.0.1",
- "hyper 1.5.1",
  "k8s-openapi",
  "kube",
  "mirrord-config",
  "mirrord-progress",
  "mirrord-protocol",
- "pin-project-lite",
  "rand",
  "regex",
  "rstest",
  "serde",
  "serde_json",
  "shellexpand",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tokio-retry",
- "tower 0.5.1",
  "tracing",
 ]
 
@@ -4431,19 +4370,14 @@ dependencies = [
  "base64 0.22.1",
  "bincode",
  "bytemuck",
- "chrono",
  "ctor",
  "envfile",
  "errno 0.3.10",
  "exec",
- "fancy-regex",
- "flaky_test",
  "frida-gum",
  "futures",
  "hashbrown 0.15.2",
- "http-body 1.0.1",
- "hyper 1.5.1",
- "k8s-openapi",
+ "hyper 1.5.2",
  "libc",
  "mirrord-config",
  "mirrord-console",
@@ -4465,10 +4399,8 @@ dependencies = [
  "tempfile",
  "test-cdylib",
  "tests",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
- "tokio-stream",
- "tower 0.5.1",
  "tracing",
  "tracing-subscriber",
 ]
@@ -4479,7 +4411,7 @@ version = "3.128.0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -4488,8 +4420,8 @@ version = "3.128.0"
 dependencies = [
  "proc-macro2",
  "proc-macro2-diagnostics",
- "semver 1.0.23",
- "syn 2.0.90",
+ "semver 1.0.24",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -4502,7 +4434,7 @@ dependencies = [
  "futures",
  "http 1.2.0",
  "http-body-util",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "k8s-openapi",
  "kube",
@@ -4513,14 +4445,13 @@ dependencies = [
  "mirrord-progress",
  "mirrord-protocol",
  "rand",
- "reqwest 0.12.9",
  "rstest",
  "schemars",
- "semver 1.0.23",
+ "semver 1.0.24",
  "serde",
  "serde_json",
  "serde_yaml",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tokio-tungstenite",
  "tracing",
@@ -4548,14 +4479,14 @@ dependencies = [
  "hickory-resolver",
  "http-body-util",
  "http-serde",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "libc",
  "mirrord-macros",
  "nix 0.29.0",
- "semver 1.0.23",
+ "semver 1.0.24",
  "serde",
  "socket2",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tokio-stream",
  "tracing",
@@ -4566,12 +4497,12 @@ name = "mirrord-sip"
 version = "3.128.0"
 dependencies = [
  "apple-codesign",
- "object 0.36.5",
+ "object 0.36.7",
  "once_cell",
  "tempfile",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tracing",
- "which 7.0.0",
+ "which 7.0.1",
 ]
 
 [[package]]
@@ -4583,11 +4514,10 @@ dependencies = [
  "k8s-openapi",
  "kube",
  "mirrord-protocol",
- "paste",
  "pnet_packet",
- "semver 1.0.23",
+ "semver 1.0.24",
  "serde_yaml",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tracing",
  "tun2",
@@ -4616,7 +4546,7 @@ dependencies = [
  "cfg-if",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -4790,7 +4720,7 @@ checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -4854,9 +4784,9 @@ dependencies = [
 
 [[package]]
 name = "object"
-version = "0.36.5"
+version = "0.36.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aedf0a2d09c573ed1d8d85b30c119153926a2b36dce0ab28322c09a117a4683e"
+checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
 dependencies = [
  "flate2",
  "memchr",
@@ -4876,7 +4806,7 @@ dependencies = [
  "serde_json",
  "strum",
  "strum_macros",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
 ]
 
 [[package]]
@@ -5038,7 +4968,7 @@ dependencies = [
  "proc-macro2",
  "proc-macro2-diagnostics",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -5068,20 +4998,20 @@ checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
 name = "pest"
-version = "2.7.14"
+version = "2.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "879952a81a83930934cbf1786752d6dedc3b1f29e8f8fb2ad1d0a36f377cf442"
+checksum = "8b7cafe60d6cf8e62e1b9b2ea516a089c008945bb5a275416789e7db0bc199dc"
 dependencies = [
  "memchr",
- "thiserror 1.0.69",
+ "thiserror 2.0.9",
  "ucd-trie",
 ]
 
 [[package]]
 name = "pest_derive"
-version = "2.7.14"
+version = "2.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d214365f632b123a47fd913301e14c946c61d1c183ee245fa76eb752e59a02dd"
+checksum = "816518421cfc6887a0d62bf441b6ffb4536fcc926395a69e1a85852d4363f57e"
 dependencies = [
  "pest",
  "pest_generator",
@@ -5089,22 +5019,22 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.7.14"
+version = "2.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb55586734301717aea2ac313f50b2eb8f60d2fc3dc01d190eefa2e625f60c4e"
+checksum = "7d1396fd3a870fc7838768d171b4616d5c91f6cc25e377b673d714567d99377b"
 dependencies = [
  "pest",
  "pest_meta",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
 name = "pest_meta"
-version = "2.7.14"
+version = "2.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b75da2a70cf4d9cb76833c990ac9cd3923c9a8905a8929789ce347c84564d03d"
+checksum = "e1e58089ea25d717bfd31fb534e4f3afcc2cc569c70de3e239778991ea3b7dea"
 dependencies = [
  "once_cell",
  "pest",
@@ -5176,7 +5106,7 @@ checksum = "3c0f5fad0874fc7abcd4d750e76917eaebbecaa2c20bde22e1dbeeba8beb758c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -5293,7 +5223,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "regex",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -5362,9 +5292,9 @@ dependencies = [
 
 [[package]]
 name = "predicates"
-version = "3.1.2"
+version = "3.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e9086cc7640c29a356d1a29fd134380bee9d8f79a17410aa76e7ad295f42c97"
+checksum = "a5d19ee57562043d37e82899fade9a22ebab7be9cef5026b07fda9cdd4293573"
 dependencies = [
  "anstyle",
  "predicates-core",
@@ -5372,15 +5302,15 @@ dependencies = [
 
 [[package]]
 name = "predicates-core"
-version = "1.0.8"
+version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae8177bee8e75d6846599c6b9ff679ed51e882816914eec639944d7c9aa11931"
+checksum = "727e462b119fe9c93fd0eb1429a5f7647394014cf3c04ab2c0350eeb09095ffa"
 
 [[package]]
 name = "predicates-tree"
-version = "1.0.11"
+version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41b740d195ed3166cd147c8047ec98db0e22ec019eb8eeb76d343b795304fb13"
+checksum = "72dd2d6d381dfb73a193c7fca536518d7caee39fc8503f74e7dc0be0531b425c"
 dependencies = [
  "predicates-core",
  "termtree",
@@ -5393,7 +5323,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "64d1ec885c64d0457d564db4ec299b2dae3f9c02808b8ad9c3a089c591b18033"
 dependencies = [
  "proc-macro2",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -5403,7 +5333,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eea25e07510aa6ab6547308ebe3c036016d162b8da920dbb079e3ba8acf3d95a"
 dependencies = [
  "csv",
- "encode_unicode 1.0.0",
+ "encode_unicode",
  "is-terminal",
  "lazy_static",
  "term",
@@ -5447,7 +5377,7 @@ dependencies = [
  "proc-macro-error-attr2",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -5467,7 +5397,7 @@ checksum = "af066a9c399a26e020ada66a034357a868728e72cd426f3adcd35f80d88d88c8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
  "version_check",
  "yansi",
 ]
@@ -5539,9 +5469,9 @@ dependencies = [
 
 [[package]]
 name = "prost"
-version = "0.13.3"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b0487d90e047de87f984913713b85c601c05609aad5b0df4b4573fbf69aa13f"
+checksum = "2c0fef6c4230e4ccf618a35c59d7ede15dea37de8427500f50aff708806e42ec"
 dependencies = [
  "bytes",
  "prost-derive",
@@ -5549,11 +5479,10 @@ dependencies = [
 
 [[package]]
 name = "prost-build"
-version = "0.13.3"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c1318b19085f08681016926435853bbf7858f9c082d0999b80550ff5d9abe15"
+checksum = "d0f3e5beed80eb580c68e2c600937ac2c4eedabdfd5ef1e5b7ea4f3fba84497b"
 dependencies = [
- "bytes",
  "heck 0.5.0",
  "itertools 0.13.0",
  "log",
@@ -5564,28 +5493,28 @@ dependencies = [
  "prost",
  "prost-types",
  "regex",
- "syn 2.0.90",
+ "syn 2.0.91",
  "tempfile",
 ]
 
 [[package]]
 name = "prost-derive"
-version = "0.13.3"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9552f850d5f0964a4e4d0bf306459ac29323ddfbae05e35a7c0d35cb0803cc5"
+checksum = "157c5a9d7ea5c2ed2d9fb8f495b64759f7816c7eaea54ba3978f0d63000162e3"
 dependencies = [
  "anyhow",
  "itertools 0.13.0",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
 name = "prost-types"
-version = "0.13.3"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4759aa0d3a6232fb8dbdb97b61de2c20047c68aca932c7ed76da9d788508d670"
+checksum = "cc2f1e56baa61e93533aebc21af4d2134b70f66275e0fcdf3cbe43d77ff7e8fc"
 dependencies = [
  "prost",
 ]
@@ -5598,9 +5527,9 @@ checksum = "106dd99e98437432fed6519dedecfade6a06a73bb7b2a1e019fdd2bee5778d94"
 
 [[package]]
 name = "quanta"
-version = "0.12.3"
+version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e5167a477619228a0b284fac2674e3c388cba90631d7b7de620e6f1fcd08da5"
+checksum = "773ce68d0bb9bc7ef20be3536ffe94e223e1f365bd374108b2659fac0c65cfe6"
 dependencies = [
  "crossbeam-utils",
  "libc",
@@ -5637,9 +5566,9 @@ dependencies = [
  "quinn-proto",
  "quinn-udp",
  "rustc-hash 2.1.0",
- "rustls 0.23.19",
+ "rustls 0.23.20",
  "socket2",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tracing",
 ]
@@ -5655,10 +5584,10 @@ dependencies = [
  "rand",
  "ring",
  "rustc-hash 2.1.0",
- "rustls 0.23.19",
+ "rustls 0.23.20",
  "rustls-pki-types",
  "slab",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tinyvec",
  "tracing",
  "web-time",
@@ -5666,9 +5595,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-udp"
-version = "0.5.7"
+version = "0.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d5a626c6807713b15cac82a6acaccd6043c9a5408c24baae07611fec3f243da"
+checksum = "1c40286217b4ba3a71d644d752e6a0b71f13f1b6a2c5311acfcbe0c2418ed904"
 dependencies = [
  "cfg_aliases",
  "libc",
@@ -5814,9 +5743,9 @@ dependencies = [
 
 [[package]]
 name = "rcgen"
-version = "0.13.1"
+version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54077e1872c46788540de1ea3d7f4ccb1983d12f9aa909b234468676c1a36779"
+checksum = "75e669e5202259b5314d1ea5397316ad400819437857b90861765f24c4cf80a2"
 dependencies = [
  "pem",
  "ring",
@@ -5838,9 +5767,9 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.7"
+version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b6dfecf2c74bce2466cabf93f6664d6998a69eb21e39f4207930065b27b771f"
+checksum = "03a862b389f93e68874fbf580b9de08dd02facb9a788ebadaf4a3fd33cf58834"
 dependencies = [
  "bitflags 2.6.0",
 ]
@@ -5926,7 +5855,7 @@ dependencies = [
  "h2 0.3.26",
  "http 0.2.12",
  "http-body 0.4.6",
- "hyper 0.14.31",
+ "hyper 0.14.32",
  "hyper-rustls 0.24.2",
  "ipnet",
  "js-sys",
@@ -5969,8 +5898,8 @@ dependencies = [
  "http 1.2.0",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.5.1",
- "hyper-rustls 0.27.3",
+ "hyper 1.5.2",
+ "hyper-rustls 0.27.5",
  "hyper-util",
  "ipnet",
  "js-sys",
@@ -5980,7 +5909,7 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "quinn",
- "rustls 0.23.19",
+ "rustls 0.23.20",
  "rustls-native-certs 0.8.1",
  "rustls-pemfile 2.2.0",
  "rustls-pki-types",
@@ -6051,7 +5980,7 @@ dependencies = [
  "regex",
  "relative-path",
  "rustc_version",
- "syn 2.0.90",
+ "syn 2.0.91",
  "unicode-ident",
 ]
 
@@ -6117,7 +6046,7 @@ version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
 dependencies = [
- "semver 1.0.23",
+ "semver 1.0.24",
 ]
 
 [[package]]
@@ -6131,15 +6060,15 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.41"
+version = "0.38.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7f649912bc1495e167a6edee79151c84b1bad49748cb4f1f1167f459f6224f6"
+checksum = "f93dc38ecbab2eb790ff964bb77fa94faf256fd3e73285fd7ba0903b76bedb85"
 dependencies = [
  "bitflags 2.6.0",
  "errno 0.3.10",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -6170,9 +6099,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.19"
+version = "0.23.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "934b404430bb06b3fae2cba809eb45a1ab1aecd64491213d7c3301b88393f8d1"
+checksum = "5065c3f250cbd332cd894be57c40fa52387247659b14a2d6041d121547903b1b"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -6218,7 +6147,7 @@ dependencies = [
  "openssl-probe",
  "rustls-pki-types",
  "schannel",
- "security-framework 3.0.1",
+ "security-framework 3.1.0",
 ]
 
 [[package]]
@@ -6241,9 +6170,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.10.0"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16f1201b3c9a7ee8039bcadc17b7e605e2945b27eee7631788c1bd2b0643674b"
+checksum = "d2bf47e6ff922db3825eb750c4e2ff784c6ff8fb9e13046ef6a1d1c5401b0b37"
 dependencies = [
  "web-time",
 ]
@@ -6349,7 +6278,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "serde_derive_internals",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -6375,7 +6304,7 @@ checksum = "7f81c2fde025af7e69b1d1420531c8a8811ca898919db177141a85313b1cb932"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -6426,9 +6355,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework"
-version = "3.0.1"
+version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1415a607e92bec364ea2cf9264646dcce0f91e6d65281bd6f2819cca3bf39c8"
+checksum = "81d3f8c9bfcc3cbb6b0179eb57042d75b1582bdc65c3cb95f3fa999509c03cbc"
 dependencies = [
  "bitflags 2.6.0",
  "core-foundation 0.10.0",
@@ -6439,9 +6368,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.12.1"
+version = "2.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa39c7303dc58b5543c94d22c1766b0d31f2ee58306363ea622b10bbc075eaa2"
+checksum = "1863fd3768cd83c56a7f60faa4dc0d403f1b6df0a38c3c25f44b7894e45370d5"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -6459,9 +6388,9 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.23"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
+checksum = "3cb6eb87a131f756572d7fb904f6e7b68633f09cca868c5df1c4b8d1a694bbba"
 dependencies = [
  "serde",
 ]
@@ -6474,9 +6403,9 @@ checksum = "388a1df253eca08550bef6c72392cfe7c30914bf41df5269b68cbd6ff8f570a3"
 
 [[package]]
 name = "serde"
-version = "1.0.215"
+version = "1.0.216"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6513c1ad0b11a9376da888e3e0baa0077f1aed55c17f50e7b2397136129fb88f"
+checksum = "0b9781016e935a97e8beecf0c933758c97a5520d32930e460142b4cd80c6338e"
 dependencies = [
  "serde_derive",
 ]
@@ -6493,13 +6422,13 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.215"
+version = "1.0.216"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad1e866f866923f252f05c889987993144fb74e722403468a4ebd70c3cd756c0"
+checksum = "46f859dbbf73865c6627ed570e78961cd3ac92407a2d117204c49232485da55e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -6510,14 +6439,14 @@ checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.133"
+version = "1.0.134"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7fceb2473b9166b2294ef05efcb65a3db80803f0b03ef86a5fc88a2b85ee377"
+checksum = "d00f4175c42ee48b15416f6193a959ba3a0d67fc699a0db9ad12df9f83991c7d"
 dependencies = [
  "itoa",
  "memchr",
@@ -6543,7 +6472,7 @@ checksum = "6c64451ba24fc7a6a2d60fc75dd9c83c90903b19028d4eff35e88fc1e86564e9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -6818,7 +6747,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -6861,9 +6790,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.90"
+version = "2.0.91"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "919d3b74a5dd0ccd15aeb8f93e7006bd9e14c295087c9896a110f490752bcf31"
+checksum = "d53cbcb5a243bd33b7858b1d7f4aca2153490815872d86d955d6ea29f743c035"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6905,7 +6834,7 @@ checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -7029,9 +6958,9 @@ dependencies = [
 
 [[package]]
 name = "termtree"
-version = "0.4.1"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3369f5ac52d5eb6ab48c6b4ffdc8efbcad6b89c765749064ba298f2c68a16a76"
+checksum = "8f50febec83f5ee1df3015341d8bd429f2d1cc62bcba7ea2076759d315084683"
 
 [[package]]
 name = "test-cdylib"
@@ -7065,7 +6994,7 @@ dependencies = [
  "futures",
  "futures-util",
  "http-body-util",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "json-patch",
  "jsonptr",
@@ -7077,7 +7006,7 @@ dependencies = [
  "regex",
  "reqwest 0.12.9",
  "rstest",
- "rustls 0.23.19",
+ "rustls 0.23.20",
  "serde",
  "serde_json",
  "tempfile",
@@ -7107,11 +7036,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.4"
+version = "2.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f49a1853cf82743e3b7950f77e0f4d622ca36cf4317cba00c767838bac8d490"
+checksum = "f072643fd0190df67a8bab670c20ef5d8737177d6ac6b2e9a236cb096206b2cc"
 dependencies = [
- "thiserror-impl 2.0.4",
+ "thiserror-impl 2.0.9",
 ]
 
 [[package]]
@@ -7122,18 +7051,18 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.4"
+version = "2.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8381894bb3efe0c4acac3ded651301ceee58a15d47c2e34885ed1908ad667061"
+checksum = "7b50fa271071aae2e6ee85f842e2e28ba8cd2c5fb67f11fcb1fd70b276f9e7d4"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -7198,9 +7127,9 @@ dependencies = [
 
 [[package]]
 name = "tinyvec"
-version = "1.8.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "445e881f4f6d382d5f27c034e25eb92edd7c784ceab92a0937db7f2e9471b938"
+checksum = "022db8904dfa342efe721985167e9fcd16c29b226db4397ed752a761cfce81e8"
 dependencies = [
  "tinyvec_macros",
 ]
@@ -7237,7 +7166,7 @@ checksum = "693d596312e88961bc67d7f1f97af8a70227d9f90c31bba5806eec004978d752"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -7267,7 +7196,7 @@ version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5f6d0975eaace0cf0fcadee4e4aaa5da15b5c079146f2cffb67c113be122bf37"
 dependencies = [
- "rustls 0.23.19",
+ "rustls 0.23.20",
  "tokio",
 ]
 
@@ -7379,7 +7308,7 @@ dependencies = [
  "http 1.2.0",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-timeout",
  "hyper-util",
  "percent-encoding",
@@ -7405,7 +7334,7 @@ dependencies = [
  "prost-build",
  "prost-types",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -7430,14 +7359,14 @@ dependencies = [
 
 [[package]]
 name = "tower"
-version = "0.5.1"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2873938d487c3cfb9aed7546dc9f2711d867c9f90c46b889989a2cb84eba6b4f"
+checksum = "d039ad9159c98b70ecfd540b2573b97f7f52c3e8d9f8ad57a24b916a536975f9"
 dependencies = [
  "futures-core",
  "futures-util",
  "pin-project-lite",
- "sync_wrapper 0.1.2",
+ "sync_wrapper 1.0.2",
  "tokio",
  "tokio-util",
  "tower-layer",
@@ -7495,7 +7424,7 @@ checksum = "395ae124c09f9e6918a2310af6038fba074bcf474ac352496d5910dd59a2226d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -7896,9 +7825,9 @@ checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.97"
+version = "0.2.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d15e63b4482863c109d70a7b8706c1e364eb6ea449b201a76c5b89cedcec2d5c"
+checksum = "a474f6281d1d70c17ae7aa6a613c87fce69a127e2624002df63dcb39d6cf6396"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -7907,24 +7836,23 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.97"
+version = "0.2.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d36ef12e3aaca16ddd3f67922bc63e48e953f126de60bd33ccc0101ef9998cd"
+checksum = "5f89bb38646b4f81674e8f5c3fb81b562be1fd936d84320f3264486418519c79"
 dependencies = [
  "bumpalo",
  "log",
- "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.47"
+version = "0.4.49"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9dfaf8f50e5f293737ee323940c7d8b08a66a95a419223d9f41610ca08b0833d"
+checksum = "38176d9b44ea84e9184eff0bc34cc167ed044f816accfe5922e54d84cf48eca2"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -7935,9 +7863,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.97"
+version = "0.2.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "705440e08b42d3e4b36de7d66c944be628d579796b8090bfa3471478a2260051"
+checksum = "2cc6181fd9a7492eef6fef1f33961e3695e4579b9872a6f7c83aee556666d4fe"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -7945,28 +7873,28 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.97"
+version = "0.2.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98c9ae5a76e46f4deecd0f0255cc223cfa18dc9b261213b8aa0c7b36f61b3f1d"
+checksum = "30d7a95b763d3c45903ed6c81f156801839e5ee968bb07e534c44df0fcd330c2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.97"
+version = "0.2.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ee99da9c5ba11bd675621338ef6fa52296b76b83305e9b6e5c77d4c286d6d49"
+checksum = "943aab3fdaaa029a6e0271b35ea10b72b943135afe9bffca82384098ad0e06a6"
 
 [[package]]
 name = "web-sys"
-version = "0.3.74"
+version = "0.3.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a98bc3c33f0fe7e59ad7cd041b89034fa82a7c2d4365ca538dda6cdaf513863c"
+checksum = "04dd7223427d52553d3702c004d3b2fe07c148165faa56313cb00211e31c12bc"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -8011,12 +7939,12 @@ dependencies = [
 
 [[package]]
 name = "which"
-version = "7.0.0"
+version = "7.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9cad3279ade7346b96e38731a641d7343dd6a53d55083dd54eadfa5a1b38c6b"
+checksum = "fb4a9e33648339dc1642b0e36e21b3385e6148e289226f657c809dee59df5028"
 dependencies = [
  "either",
- "home",
+ "env_home",
  "rustix",
  "winsafe",
 ]
@@ -8299,16 +8227,16 @@ checksum = "d135d17ab770252ad95e9a872d365cf3090e3be864a34ab46f48555993efc904"
 
 [[package]]
 name = "wintun-bindings"
-version = "0.7.19"
+version = "0.7.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50da04a12b4acd77944c4e3501a61e754dc798dadcab063c9bf1d7c40081ec41"
+checksum = "bcc6dd9245a46abcd079e3b220b86a7d49bf19ab36a431ca9ce9df6c9a2b74bc"
 dependencies = [
  "blocking",
  "c2rust-bitfields",
  "futures",
  "libloading",
  "log",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "windows-sys 0.59.0",
  "winreg 0.52.0",
 ]
@@ -8481,7 +8409,7 @@ checksum = "2380878cad4ac9aac1e2435f3eb4020e8374b5f13c296cb75b4620ff8e229154"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
  "synstructure 0.13.1",
 ]
 
@@ -8503,7 +8431,7 @@ checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -8523,7 +8451,7 @@ checksum = "595eed982f7d355beb85837f651fa22e90b3c044842dc7f2c2842c086f295808"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
  "synstructure 0.13.1",
 ]
 
@@ -8544,7 +8472,7 @@ checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
@@ -8566,7 +8494,7 @@ checksum = "6eafa6dfb17584ea3e2bd6e76e0cc15ad7af12b09abdd1ca55961bed9b1063c6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.91",
 ]
 
 [[package]]
diff --git a/changelog.d/+http-filter-docs.changed.md b/changelog.d/+http-filter-docs.changed.md
new file mode 100644
index 00000000000..75a6917214a
--- /dev/null
+++ b/changelog.d/+http-filter-docs.changed.md
@@ -0,0 +1 @@
+Extended docs for HTTP filter in the mirrord config.
\ No newline at end of file
diff --git a/changelog.d/2843.internal.md b/changelog.d/2843.internal.md
new file mode 100644
index 00000000000..c3587426952
--- /dev/null
+++ b/changelog.d/2843.internal.md
@@ -0,0 +1 @@
+Added lint for unused crate dependencies.
\ No newline at end of file
diff --git a/changelog.d/2986.changed.md b/changelog.d/2986.changed.md
new file mode 100644
index 00000000000..f17b5621854
--- /dev/null
+++ b/changelog.d/2986.changed.md
@@ -0,0 +1 @@
+Changed log level for debugger ports detection.
\ No newline at end of file
diff --git a/medschool/src/main.rs b/medschool/src/main.rs
index 8d5c9692c65..13a92ea51ba 100644
--- a/medschool/src/main.rs
+++ b/medschool/src/main.rs
@@ -14,6 +14,7 @@
 #![feature(iterator_try_collect)]
 #![deny(clippy::missing_docs_in_private_items)]
 #![deny(missing_docs)]
+#![deny(unused_crate_dependencies)]
 
 use std::{fs, fs::File, io::Read, path::PathBuf};
 
diff --git a/mirrord-schema.json b/mirrord-schema.json
index 2340d40ea8c..61999d68351 100644
--- a/mirrord-schema.json
+++ b/mirrord-schema.json
@@ -1090,12 +1090,12 @@
       ]
     },
     "HttpFilterFileConfig": {
-      "description": "Filter configuration for the HTTP traffic stealer feature.\n\nAllows the user to set a filter (regex) for the HTTP headers, so that the stealer traffic feature only captures HTTP requests that match the specified filter, forwarding unmatched requests to their original destinations.\n\nOnly does something when [`feature.network.incoming.mode`](#feature-network-incoming-mode) is set as `\"steal\"`, ignored otherwise.\n\nFor example, to filter based on header: ```json { \"header_filter\": \"host: api\\\\..+\" } ``` Setting that filter will make mirrord only steal requests with the `host` header set to hosts that start with \"api\", followed by a dot, and then at least one more character.\n\nFor example, to filter based on path: ```json { \"path_filter\": \"^/api/\" } ``` Setting this filter will make mirrord only steal requests to URIs starting with \"/api/\".\n\nThis can be useful for filtering out Kubernetes liveness, readiness and startup probes. For example, for avoiding stealing any probe sent by kubernetes, you can set this filter: ```json { \"header_filter\": \"^User-Agent: (?!kube-probe)\" } ``` Setting this filter will make mirrord only steal requests that **do** have a user agent that **does not** begin with \"kube-probe\".\n\nSimilarly, you can exclude certain paths using a negative look-ahead: ```json { \"path_filter\": \"^(?!/health/)\" } ``` Setting this filter will make mirrord only steal requests to URIs that do not start with \"/health/\".",
+      "description": "Filter configuration for the HTTP traffic stealer feature.\n\nAllows the user to set a filter (regex) for the HTTP headers, so that the stealer traffic feature only captures HTTP requests that match the specified filter, forwarding unmatched requests to their original destinations.\n\nOnly does something when [`feature.network.incoming.mode`](#feature-network-incoming-mode) is set as `\"steal\"`, ignored otherwise.\n\nFor example, to filter based on header: ```json { \"header_filter\": \"host: api\\\\..+\" } ``` Setting that filter will make mirrord only steal requests with the `host` header set to hosts that start with \"api\", followed by a dot, and then at least one more character.\n\nFor example, to filter based on path: ```json { \"path_filter\": \"^/api/\" } ``` Setting this filter will make mirrord only steal requests to URIs starting with \"/api/\".\n\nThis can be useful for filtering out Kubernetes liveness, readiness and startup probes. For example, for avoiding stealing any probe sent by kubernetes, you can set this filter: ```json { \"header_filter\": \"^User-Agent: (?!kube-probe)\" } ``` Setting this filter will make mirrord only steal requests that **do** have a user agent that **does not** begin with \"kube-probe\".\n\nSimilarly, you can exclude certain paths using a negative look-ahead: ```json { \"path_filter\": \"^(?!/health/)\" } ``` Setting this filter will make mirrord only steal requests to URIs that do not start with \"/health/\".\n\nWith `all_of` and `any_of`, you can use multiple HTTP filters at the same time.\n\nIf you want to steal HTTP requests that match **every** pattern specified, use `all_of`. For example, this filter steals only HTTP requests to endpoint `/api/my-endpoint` that contain header `x-debug-session` with value `121212`. ```json { \"all_of\": [ { \"header\": \"^x-debug-session: 121212$\" }, { \"path\": \"^/api/my-endpoint$\" } ] }\n\nIf you want to steal HTTP requests that match **any** of the patterns specified, use `any_of`. For example, this filter steals HTTP requests to endpoint `/api/my-endpoint` **and** HTTP requests that contain header `x-debug-session` with value `121212`. ```json { \"any_of\": [ { \"path\": \"^/api/my-endpoint$\"}, { \"header\": \"^x-debug-session: 121212$\" } ] }",
       "type": "object",
       "properties": {
         "all_of": {
           "title": "feature.network.incoming.http_filter.all_of {#feature-network-incoming-http_filter-all_of}",
-          "description": "Messages must match all of the specified filters. Cannot be an empty list.",
+          "description": "An array of HTTP filters.\n\nEach inner filter specifies either header or path regex. Requests must match all of the filters to be stolen.\n\nCannot be an empty list.\n\nExample: ```json { \"all_of\": [ { \"header\": \"x-user: my-user$\" }, { \"path\": \"^/api/v1/my-endpoint\" } ] } ```",
           "type": [
             "array",
             "null"
@@ -1106,7 +1106,7 @@
         },
         "any_of": {
           "title": "feature.network.incoming.http_filter.any_of {#feature-network-incoming-http_filter-any_of}",
-          "description": "Messages must match any of the specified filters. Cannot be an empty list.",
+          "description": "An array of HTTP filters.\n\nEach inner filter specifies either header or path regex. Requests must match at least one of the filters to be stolen.\n\nCannot be an empty list.\n\nExample: ```json { \"any_of\": [ { \"header\": \"^x-user: my-user$\" }, { \"path\": \"^/api/v1/my-endpoint\" } ] } ```",
           "type": [
             "array",
             "null"
diff --git a/mirrord/agent/Cargo.toml b/mirrord/agent/Cargo.toml
index cd2f5779123..07757b7900e 100644
--- a/mirrord/agent/Cargo.toml
+++ b/mirrord/agent/Cargo.toml
@@ -18,7 +18,7 @@ workspace = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
-[dependencies]
+[target.'cfg(target_os = "linux")'.dependencies]
 containerd-client = "0.6"
 tokio = { workspace = true, features = [
     "rt",
@@ -49,7 +49,6 @@ streammap-ext.workspace = true
 libc.workspace = true
 faccess = "0.2"
 bytes.workspace = true
-regex.workspace = true
 wildmatch = "2"
 enum_dispatch.workspace = true
 http-body-util = { workspace = true }
@@ -72,14 +71,11 @@ envy = "0.4"
 socket2.workspace = true
 prometheus = { version = "0.13", features = ["process"] }
 axum = { version = "0.7", features = ["macros"] }
-axum-server = "0.7"
-
-[target.'cfg(target_os = "linux")'.dependencies]
 iptables = { git = "https://github.com/metalbear-co/rust-iptables.git", rev = "e66c7332e361df3c61a194f08eefe3f40763d624" }
 rawsocket = { git = "https://github.com/metalbear-co/rawsocket.git" }
 procfs = "0.17.0"
 
-[dev-dependencies]
+[target.'cfg(target_os = "linux")'.dev-dependencies]
 rstest.workspace = true
 mockall = "0.13"
 test_bin = "0.4"
diff --git a/mirrord/agent/src/main.rs b/mirrord/agent/src/main.rs
index b8c504041ec..e9f3e107907 100644
--- a/mirrord/agent/src/main.rs
+++ b/mirrord/agent/src/main.rs
@@ -1,55 +1,39 @@
+#![cfg(target_os = "linux")]
 #![feature(hash_extract_if)]
 #![feature(let_chains)]
 #![feature(iterator_try_collect)]
 #![feature(try_blocks)]
-#![cfg_attr(target_os = "linux", feature(tcp_quickack))]
+#![feature(tcp_quickack)]
 #![warn(clippy::indexing_slicing)]
+#![deny(unused_crate_dependencies)]
+
+/// Silences `deny(unused_crate_dependencies)`.
+///
+/// This dependency is only used in integration tests.
+#[cfg(test)]
+use test_bin as _;
 
-#[cfg(target_os = "linux")]
 mod cli;
-#[cfg(target_os = "linux")]
 mod client_connection;
-#[cfg(target_os = "linux")]
 mod container_handle;
-#[cfg(target_os = "linux")]
 mod dns;
-#[cfg(target_os = "linux")]
 mod entrypoint;
-#[cfg(target_os = "linux")]
 mod env;
-#[cfg(target_os = "linux")]
 mod error;
-#[cfg(target_os = "linux")]
 mod file;
-#[cfg(target_os = "linux")]
 mod http;
-#[cfg(target_os = "linux")]
+mod metrics;
 mod namespace;
-#[cfg(target_os = "linux")]
 mod outgoing;
-#[cfg(target_os = "linux")]
 mod runtime;
-#[cfg(target_os = "linux")]
 mod sniffer;
-#[cfg(target_os = "linux")]
 mod steal;
-#[cfg(target_os = "linux")]
 mod util;
-#[cfg(target_os = "linux")]
 mod vpn;
-#[cfg(target_os = "linux")]
 mod watched_task;
 
-#[cfg(target_os = "linux")]
-mod metrics;
-
 #[cfg(target_os = "linux")]
 #[tokio::main(flavor = "current_thread")]
 async fn main() -> crate::error::AgentResult<()> {
     crate::entrypoint::main().await
 }
-
-#[cfg(not(target_os = "linux"))]
-fn main() {
-    panic!("This program is only supported on Linux");
-}
diff --git a/mirrord/agent/src/steal/ip_tables.rs b/mirrord/agent/src/steal/ip_tables.rs
index 6b131262cbf..82f2c5031cf 100644
--- a/mirrord/agent/src/steal/ip_tables.rs
+++ b/mirrord/agent/src/steal/ip_tables.rs
@@ -19,36 +19,6 @@ use crate::{
     },
 };
 
-#[cfg(not(target_os = "linux"))]
-mod iptables {
-    pub struct IPTables;
-
-    impl IPTables {
-        pub fn list(&self, _: &str, _: &str) -> AgentResult<Vec<String>, String> {
-            todo!()
-        }
-        pub fn insert(&self, _: &str, _: &str, _: &str, _: i32) -> AgentResult<(), String> {
-            todo!()
-        }
-        pub fn append(&self, _: &str, _: &str, _: &str) -> AgentResult<(), String> {
-            todo!()
-        }
-        pub fn delete(&self, _: &str, _: &str, _: &str) -> AgentResult<(), String> {
-            todo!()
-        }
-
-        pub fn new_chain(&self, _: &str, _: &str) -> AgentResult<(), String> {
-            todo!()
-        }
-        pub fn delete_chain(&self, _: &str, _: &str) -> AgentResult<(), String> {
-            todo!()
-        }
-        pub fn flush_chain(&self, _: &str, _: &str) -> AgentResult<(), String> {
-            todo!()
-        }
-    }
-}
-
 pub(crate) mod chain;
 pub(crate) mod flush_connections;
 pub(crate) mod mesh;
diff --git a/mirrord/agent/src/steal/orig_dst.rs b/mirrord/agent/src/steal/orig_dst.rs
index d3eddba67ea..c0040b4270c 100644
--- a/mirrord/agent/src/steal/orig_dst.rs
+++ b/mirrord/agent/src/steal/orig_dst.rs
@@ -5,7 +5,6 @@ use std::{io, net::SocketAddr};
 
 use tokio::net::TcpStream;
 
-#[cfg(target_os = "linux")]
 #[allow(unsafe_code)]
 #[tracing::instrument(level = "trace")]
 pub(super) fn orig_dst_addr(sock: &TcpStream) -> io::Result<SocketAddr> {
@@ -14,15 +13,6 @@ pub(super) fn orig_dst_addr(sock: &TcpStream) -> io::Result<SocketAddr> {
     unsafe { linux::so_original_dst(fd) }
 }
 
-#[cfg(not(target_os = "linux"))]
-pub(super) fn orig_dst_addr(_: &TcpStream) -> io::Result<SocketAddr> {
-    Err(io::Error::new(
-        io::ErrorKind::Other,
-        "SO_ORIGINAL_DST not supported on this operating system",
-    ))
-}
-
-#[cfg(target_os = "linux")]
 #[allow(unsafe_code)]
 mod linux {
     use std::{
diff --git a/mirrord/agent/tests/blackbox.rs b/mirrord/agent/tests/blackbox.rs
index 3dfccf6374c..b40d0ea9d2b 100644
--- a/mirrord/agent/tests/blackbox.rs
+++ b/mirrord/agent/tests/blackbox.rs
@@ -1,151 +1,149 @@
-#[cfg(test)]
-mod tests {
-    use std::{io::ErrorKind, net::IpAddr, sync::Arc};
+use std::{io::ErrorKind, net::IpAddr, sync::Arc};
 
-    use actix_codec::Framed;
-    use futures::SinkExt;
-    use mirrord_protocol::{
-        tcp::{DaemonTcp, LayerTcp, NewTcpConnection, TcpClose, TcpData},
-        ClientCodec, ClientMessage, DaemonMessage,
-    };
-    use test_bin::get_test_bin;
-    use tokio::{
-        io::AsyncWriteExt,
-        net::{TcpListener, TcpStream},
-        select,
-        sync::Mutex,
-        time::{sleep, Duration},
-    };
-    use tokio_stream::StreamExt;
+use actix_codec::Framed;
+use futures::SinkExt;
+use mirrord_protocol::{
+    tcp::{DaemonTcp, LayerTcp, NewTcpConnection, TcpClose, TcpData},
+    ClientCodec, ClientMessage, DaemonMessage,
+};
+use test_bin::get_test_bin;
+use tokio::{
+    io::AsyncWriteExt,
+    net::{TcpListener, TcpStream},
+    select,
+    sync::Mutex,
+    time::{sleep, Duration},
+};
+use tokio_stream::StreamExt;
 
-    #[tokio::test]
-    async fn sanity() {
-        let mut bin = get_test_bin("mirrord-agent");
-        // we do wait, not sure what's happened
-        #[allow(clippy::zombie_processes)]
-        let child = bin
-            .arg("-t")
-            .arg("2")
-            .arg("-i")
-            .arg("lo")
-            .arg("blackbox-test")
-            .spawn()
-            .expect("mirrord-agent failed to start");
-        // Wait for agent to listen
-        sleep(Duration::from_millis(2000)).await;
-        let stream = TcpStream::connect("127.0.0.1:61337")
+/// This test requires root or CAP_NET_RAW to setup TCP sniffing.
+#[tokio::test]
+async fn sanity() {
+    let mut bin = get_test_bin("mirrord-agent");
+    // we do wait, not sure what's happened
+    #[allow(clippy::zombie_processes)]
+    let child = bin
+        .arg("-t")
+        .arg("2")
+        .arg("-i")
+        .arg("lo")
+        .arg("blackbox-test")
+        .spawn()
+        .expect("mirrord-agent failed to start");
+    // Wait for agent to listen
+    sleep(Duration::from_millis(2000)).await;
+    let stream = TcpStream::connect("127.0.0.1:61337")
+        .await
+        .expect("connection to agent failed");
+    let mutex = Arc::new(Mutex::new(0));
+    let task_mutex = Arc::clone(&mutex);
+    let guard = mutex.lock().await;
+    let task = tokio::spawn(async move {
+        let listener = TcpListener::bind("127.0.0.1:1337")
             .await
-            .expect("connection to agent failed");
-        let mutex = Arc::new(Mutex::new(0));
-        let task_mutex = Arc::clone(&mutex);
-        let guard = mutex.lock().await;
-        let task = tokio::spawn(async move {
-            let listener = TcpListener::bind("127.0.0.1:1337")
-                .await
-                .expect("couldn't bind socket");
-            loop {
-                select! {
-                    Ok((socket, _)) = listener.accept() => {
-                        let mut buf = [0; 4096];
-                        loop {
-                            match socket.try_read(&mut buf) {
-                                Ok(0) => break,
-                                Ok(_) => {}
-                                Err(ref e) if e.kind() == ErrorKind::WouldBlock => {
-                                    sleep(Duration::from_millis(10)).await;
-                                }
-                                Err(e) => panic!("socket error {e:?}")
+            .expect("couldn't bind socket");
+        loop {
+            select! {
+                Ok((socket, _)) = listener.accept() => {
+                    let mut buf = [0; 4096];
+                    loop {
+                        match socket.try_read(&mut buf) {
+                            Ok(0) => break,
+                            Ok(_) => {}
+                            Err(ref e) if e.kind() == ErrorKind::WouldBlock => {
+                                sleep(Duration::from_millis(10)).await;
                             }
+                            Err(e) => panic!("socket error {e:?}")
                         }
-                    },
-                    _ = task_mutex.lock() => {
-                        break
                     }
+                },
+                _ = task_mutex.lock() => {
+                    break
                 }
             }
-        });
+        }
+    });
 
-        let mut codec = Framed::new(stream, ClientCodec::default());
-        let subscription_port = 1337;
+    let mut codec = Framed::new(stream, ClientCodec::default());
+    let subscription_port = 1337;
 
+    codec
+        .send(ClientMessage::Tcp(LayerTcp::PortSubscribe(
+            subscription_port,
+        )))
+        .await
+        .expect("port subscribe failed");
+    assert!(matches!(
         codec
-            .send(ClientMessage::Tcp(LayerTcp::PortSubscribe(
-                subscription_port,
-            )))
-            .await
-            .expect("port subscribe failed");
-        assert!(matches!(
-            codec
-                .next()
-                .await
-                .expect("couldn't get next message")
-                .expect("got invalid message"),
-            DaemonMessage::Tcp(DaemonTcp::SubscribeResult(Ok(_)))
-        ));
-        let mut test_conn = TcpStream::connect("127.0.0.1:1337")
-            .await
-            .expect("connection to dummy failed");
-        let port = test_conn.local_addr().unwrap().port();
-        let test_data = [0, 3, 5];
-        test_conn
-            .write_all(&test_data)
-            .await
-            .expect("couldn't write test data");
-        drop(test_conn);
-        let new_conn_msg = codec
-            .next()
-            .await
-            .expect("couldn't get next message")
-            .expect("got invalid message");
-        let data_msg = codec
-            .next()
-            .await
-            .expect("couldn't get next message")
-            .expect("got invalid message");
-        let close_msg = codec
             .next()
             .await
             .expect("couldn't get next message")
-            .expect("got invalid message");
-        assert_eq!(
-            new_conn_msg,
-            DaemonMessage::Tcp(DaemonTcp::NewConnection(NewTcpConnection {
-                connection_id: 0,
-                remote_address: IpAddr::V4("127.0.0.1".parse().unwrap()),
-                local_address: IpAddr::V4("127.0.0.1".parse().unwrap()),
-                destination_port: 1337,
-                source_port: port
-            }))
-        );
+            .expect("got invalid message"),
+        DaemonMessage::Tcp(DaemonTcp::SubscribeResult(Ok(_)))
+    ));
+    let mut test_conn = TcpStream::connect("127.0.0.1:1337")
+        .await
+        .expect("connection to dummy failed");
+    let port = test_conn.local_addr().unwrap().port();
+    let test_data = [0, 3, 5];
+    test_conn
+        .write_all(&test_data)
+        .await
+        .expect("couldn't write test data");
+    drop(test_conn);
+    let new_conn_msg = codec
+        .next()
+        .await
+        .expect("couldn't get next message")
+        .expect("got invalid message");
+    let data_msg = codec
+        .next()
+        .await
+        .expect("couldn't get next message")
+        .expect("got invalid message");
+    let close_msg = codec
+        .next()
+        .await
+        .expect("couldn't get next message")
+        .expect("got invalid message");
+    assert_eq!(
+        new_conn_msg,
+        DaemonMessage::Tcp(DaemonTcp::NewConnection(NewTcpConnection {
+            connection_id: 0,
+            remote_address: IpAddr::V4("127.0.0.1".parse().unwrap()),
+            local_address: IpAddr::V4("127.0.0.1".parse().unwrap()),
+            destination_port: 1337,
+            source_port: port
+        }))
+    );
 
-        assert_eq!(
-            data_msg,
-            DaemonMessage::Tcp(DaemonTcp::Data(TcpData {
-                connection_id: 0,
-                bytes: test_data.to_vec()
-            }))
-        );
+    assert_eq!(
+        data_msg,
+        DaemonMessage::Tcp(DaemonTcp::Data(TcpData {
+            connection_id: 0,
+            bytes: test_data.to_vec()
+        }))
+    );
 
-        assert_eq!(
-            close_msg,
-            DaemonMessage::Tcp(DaemonTcp::Close(TcpClose { connection_id: 0 }))
-        );
+    assert_eq!(
+        close_msg,
+        DaemonMessage::Tcp(DaemonTcp::Close(TcpClose { connection_id: 0 }))
+    );
 
-        drop(codec);
-        drop(guard);
-        drop(mutex);
+    drop(codec);
+    drop(guard);
+    drop(mutex);
 
-        task.await.unwrap();
-        let result = child.wait_with_output().unwrap();
-        assert!(result.status.success());
+    task.await.unwrap();
+    let result = child.wait_with_output().unwrap();
+    assert!(result.status.success());
 
-        let stderr = String::from_utf8_lossy(&result.stderr);
-        println!("stderr: {stderr:?}");
+    let stderr = String::from_utf8_lossy(&result.stderr);
+    println!("stderr: {stderr:?}");
 
-        let stdout = String::from_utf8_lossy(&result.stdout);
-        println!("stdout: {stdout:?}");
+    let stdout = String::from_utf8_lossy(&result.stdout);
+    println!("stdout: {stdout:?}");
 
-        assert!(!stderr.to_ascii_lowercase().contains("error"));
-        assert!(!stdout.to_ascii_lowercase().contains("error"));
-    }
+    assert!(!stderr.to_ascii_lowercase().contains("error"));
+    assert!(!stdout.to_ascii_lowercase().contains("error"));
 }
diff --git a/mirrord/analytics/src/lib.rs b/mirrord/analytics/src/lib.rs
index bb05773544a..ff21df83626 100644
--- a/mirrord/analytics/src/lib.rs
+++ b/mirrord/analytics/src/lib.rs
@@ -1,3 +1,5 @@
+#![deny(unused_crate_dependencies)]
+
 use std::{collections::HashMap, str::FromStr, time::Instant};
 
 use base64::{engine::general_purpose, Engine as _};
diff --git a/mirrord/auth/Cargo.toml b/mirrord/auth/Cargo.toml
index 0e81570e17f..501b9bbeb88 100644
--- a/mirrord/auth/Cargo.toml
+++ b/mirrord/auth/Cargo.toml
@@ -25,8 +25,11 @@ client = [
 	"dep:fs4",
 	"dep:k8s-openapi",
 	"dep:kube",
+	"dep:reqwest",
 	"dep:serde_yaml",
+	"dep:thiserror",
 	"dep:tokio",
+	"dep:tracing",
 	"dep:whoami"
 ]
 
@@ -41,11 +44,10 @@ kube = { workspace = true, optional = true }
 serde = { version = "1", features = ["derive"] }
 serde_yaml = { workspace = true, optional = true }
 tokio = { workspace = true, features = ["fs"], optional = true  }
-thiserror.workspace = true
+thiserror = { workspace = true, optional = true }
 x509-certificate = "0.24"
-# not direct dependency, but if we don't put it here it'll use openssl :(
 reqwest = { workspace = true, features=["json", "rustls-tls-native-roots"], default-features = false, optional = true }
-tracing.workspace = true
+tracing = { workspace = true, optional = true }
 
 [dev-dependencies]
 bcder = "0.7"
diff --git a/mirrord/auth/src/credentials.rs b/mirrord/auth/src/credentials.rs
index 062918bff1d..4032dde173b 100644
--- a/mirrord/auth/src/credentials.rs
+++ b/mirrord/auth/src/credentials.rs
@@ -3,9 +3,10 @@ use std::fmt::Debug;
 use chrono::{DateTime, NaiveDate, Utc};
 use serde::{Deserialize, Serialize};
 pub use x509_certificate;
+use x509_certificate::{asn1time::Time, rfc5280};
+#[cfg(feature = "client")]
 use x509_certificate::{
-    asn1time::Time, rfc2986, rfc5280, InMemorySigningKeyPair, X509CertificateBuilder,
-    X509CertificateError,
+    rfc2986, InMemorySigningKeyPair, X509CertificateBuilder, X509CertificateError,
 };
 
 use crate::{certificate::Certificate, key_pair::KeyPair};
@@ -38,6 +39,7 @@ impl Credentials {
     }
 
     /// Creates [`rfc2986::CertificationRequest`] for [`Certificate`] generation in the operator.
+    #[cfg(feature = "client")]
     fn certificate_request(
         common_name: &str,
         key_pair: &InMemorySigningKeyPair,
diff --git a/mirrord/auth/src/error.rs b/mirrord/auth/src/error.rs
index 3488568907d..71e9a3b6222 100644
--- a/mirrord/auth/src/error.rs
+++ b/mirrord/auth/src/error.rs
@@ -3,7 +3,6 @@ use x509_certificate::X509CertificateError;
 
 /// Errors from [`CredentialStore`](crate::credential_store::CredentialStore) and
 /// [`CredentialStoreSync`](crate::credential_store::CredentialStoreSync) operations
-#[cfg(feature = "client")]
 #[derive(Debug, Error)]
 pub enum CredentialStoreError {
     #[error("failed to parent directory for credential store file: {0}")]
diff --git a/mirrord/auth/src/lib.rs b/mirrord/auth/src/lib.rs
index 677f057815a..1ade1731ba2 100644
--- a/mirrord/auth/src/lib.rs
+++ b/mirrord/auth/src/lib.rs
@@ -1,8 +1,20 @@
 #![doc = include_str!("../README.md")]
+#![deny(unused_crate_dependencies)]
 
 pub use pem;
 pub use x509_certificate;
 
+/// Silences `deny(unused_crate_dependencies)`.
+///
+/// Although we don't use these dependencies directly, we need them here.
+#[cfg(feature = "client")]
+mod compilation_deps {
+    /// Compilation fails without it.
+    use k8s_openapi as _;
+    /// We use it with rustls enabled to prevent [`kube`] from using openssl.
+    use reqwest as _;
+}
+
 /// X509 Certificate abstraction for serialization and deserialization
 pub mod certificate;
 /// FileSystem based storage for multiple credentials (default contents "~/.mirrord/credentials")
@@ -11,6 +23,7 @@ pub mod credential_store;
 /// Credentials used to create from and validate against Operator License
 pub mod credentials;
 /// Error types
+#[cfg(feature = "client")]
 pub mod error;
 /// Public/Private key abstraction for serialization and deserialization
 pub mod key_pair;
diff --git a/mirrord/cli/Cargo.toml b/mirrord/cli/Cargo.toml
index ca973e44de0..420ec6e97f1 100644
--- a/mirrord/cli/Cargo.toml
+++ b/mirrord/cli/Cargo.toml
@@ -22,12 +22,11 @@ workspace = true
 mirrord-console = { path = "../console", features = ["async-logger"] }
 mirrord-operator = { path = "../operator", features = [
     "client",
-    "license-fetch",
     "setup",
 ] }
 mirrord-intproxy-protocol = { path = "../intproxy/protocol" }
 mirrord-progress = { path = "../progress" }
-mirrord-kube = { path = "../kube" }
+mirrord-kube = { path = "../kube", features = ["portforward"] }
 mirrord-config = { path = "../config" }
 mirrord-protocol = { path = "../protocol" }
 mirrord-analytics = { path = "../analytics" }
@@ -37,7 +36,6 @@ mirrord-vpn = { path = "../vpn" }
 actix-codec.workspace = true
 clap.workspace = true
 envfile.workspace = true
-tun2 = { workspace = true, features = ["async"] }
 tracing.workspace = true
 serde_json.workspace = true
 serde.workspace = true
@@ -45,7 +43,6 @@ tracing-subscriber.workspace = true
 futures.workspace = true
 which.workspace = true
 semver.workspace = true
-exec.workspace = true
 reqwest.workspace = true
 const-random = "0.1.15"
 tokio = { workspace = true, features = ["rt", "net", "macros", "process"] }
@@ -67,7 +64,6 @@ rcgen.workspace = true
 rustls-pemfile.workspace = true
 tokio-rustls.workspace = true
 tokio-stream = { workspace = true, features = ["net"] }
-tokio-retry = "0.3"
 regex.workspace = true
 mid = "3.0.0"
 rand.workspace = true
@@ -82,6 +78,5 @@ mirrord-layer = { artifact = "cdylib", path = "../layer" }
 rstest.workspace = true
 hyper.workspace = true
 hyper-util = { workspace = true, "features" = ["server"] }
-http-body.workspace = true
 http-body-util.workspace = true
 kube.workspace = true
diff --git a/mirrord/cli/src/connection.rs b/mirrord/cli/src/connection.rs
index c5120b43487..dacec4fcb1b 100644
--- a/mirrord/cli/src/connection.rs
+++ b/mirrord/cli/src/connection.rs
@@ -181,7 +181,7 @@ where
 
     let (sender, receiver) = wrap_raw_connection(
         k8s_api
-            .create_connection(agent_connect_info.clone())
+            .create_connection_portforward(agent_connect_info.clone())
             .await
             .map_err(|error| {
                 CliError::friendlier_error_or_else(error, CliError::AgentConnectionFailed)
diff --git a/mirrord/cli/src/main.rs b/mirrord/cli/src/main.rs
index 9213c1cc57a..27923cab4fd 100644
--- a/mirrord/cli/src/main.rs
+++ b/mirrord/cli/src/main.rs
@@ -1,6 +1,7 @@
 #![feature(let_chains)]
 #![feature(try_blocks)]
 #![warn(clippy::indexing_slicing)]
+#![deny(unused_crate_dependencies)]
 
 use std::{
     collections::HashMap, env::vars, ffi::CString, net::SocketAddr, os::unix::ffi::OsStrExt,
diff --git a/mirrord/config/configuration.md b/mirrord/config/configuration.md
index ec32b677e86..6bb7a78633f 100644
--- a/mirrord/config/configuration.md
+++ b/mirrord/config/configuration.md
@@ -1124,16 +1124,68 @@ Similarly, you can exclude certain paths using a negative look-ahead:
 Setting this filter will make mirrord only steal requests to URIs that do not start with
 "/health/".
 
-#### feature.network.incoming.http_filter.all_of {#feature-network-incoming-http_filter-all_of}
+With `all_of` and `any_of`, you can use multiple HTTP filters at the same time.
+
+If you want to steal HTTP requests that match **every** pattern specified, use `all_of`.
+For example, this filter steals only HTTP requests to endpoint `/api/my-endpoint` that contain
+header `x-debug-session` with value `121212`.
+```json
+{
+  "all_of": [
+    { "header": "^x-debug-session: 121212$" },
+    { "path": "^/api/my-endpoint$" }
+  ]
+}
+
+If you want to steal HTTP requests that match **any** of the patterns specified, use `any_of`.
+For example, this filter steals HTTP requests to endpoint `/api/my-endpoint`
+**and** HTTP requests that contain header `x-debug-session` with value `121212`.
+```json
+{
+ "any_of": [
+   { "path": "^/api/my-endpoint$"},
+   { "header": "^x-debug-session: 121212$" }
+ ]
+}
+
+##### feature.network.incoming.http_filter.all_of {#feature-network-incoming-http_filter-all_of}
+
+An array of HTTP filters.
+
+Each inner filter specifies either header or path regex.
+Requests must match all of the filters to be stolen.
 
-Messages must match all of the specified filters.
 Cannot be an empty list.
 
-#### feature.network.incoming.http_filter.any_of {#feature-network-incoming-http_filter-any_of}
+Example:
+```json
+{
+  "all_of": [
+    { "header": "x-user: my-user$" },
+    { "path": "^/api/v1/my-endpoint" }
+  ]
+}
+```
+
+##### feature.network.incoming.http_filter.any_of {#feature-network-incoming-http_filter-any_of}
+
+An array of HTTP filters.
+
+Each inner filter specifies either header or path regex.
+Requests must match at least one of the filters to be stolen.
 
-Messages must match any of the specified filters.
 Cannot be an empty list.
 
+Example:
+```json
+{
+  "any_of": [
+    { "header": "^x-user: my-user$" },
+    { "path": "^/api/v1/my-endpoint" }
+  ]
+}
+```
+
 ##### feature.network.incoming.http_filter.header_filter {#feature-network-incoming-http-header-filter}
 
 
diff --git a/mirrord/config/src/feature/network/incoming/http_filter.rs b/mirrord/config/src/feature/network/incoming/http_filter.rs
index e79adc724e2..343e850b75d 100644
--- a/mirrord/config/src/feature/network/incoming/http_filter.rs
+++ b/mirrord/config/src/feature/network/incoming/http_filter.rs
@@ -55,6 +55,30 @@ use crate::{
 /// ```
 /// Setting this filter will make mirrord only steal requests to URIs that do not start with
 /// "/health/".
+///
+/// With `all_of` and `any_of`, you can use multiple HTTP filters at the same time.
+///
+/// If you want to steal HTTP requests that match **every** pattern specified, use `all_of`.
+/// For example, this filter steals only HTTP requests to endpoint `/api/my-endpoint` that contain
+/// header `x-debug-session` with value `121212`.
+/// ```json
+/// {
+///   "all_of": [
+///     { "header": "^x-debug-session: 121212$" },
+///     { "path": "^/api/my-endpoint$" }
+///   ]
+/// }
+///
+/// If you want to steal HTTP requests that match **any** of the patterns specified, use `any_of`.
+/// For example, this filter steals HTTP requests to endpoint `/api/my-endpoint`
+/// **and** HTTP requests that contain header `x-debug-session` with value `121212`.
+/// ```json
+///{
+///  "any_of": [
+///    { "path": "^/api/my-endpoint$"},
+///    { "header": "^x-debug-session: 121212$" }
+///  ]
+///}
 #[derive(MirrordConfig, Default, PartialEq, Eq, Clone, Debug, Serialize)]
 #[config(map_to = "HttpFilterFileConfig", derive = "JsonSchema")]
 #[cfg_attr(test, config(derive = "PartialEq, Eq"))]
@@ -81,16 +105,44 @@ pub struct HttpFilterConfig {
     #[config(env = "MIRRORD_HTTP_PATH_FILTER")]
     pub path_filter: Option<String>,
 
-    /// #### feature.network.incoming.http_filter.all_of {#feature-network-incoming-http_filter-all_of}
+    /// ##### feature.network.incoming.http_filter.all_of {#feature-network-incoming-http_filter-all_of}
+    ///
+    /// An array of HTTP filters.
+    ///
+    /// Each inner filter specifies either header or path regex.
+    /// Requests must match all of the filters to be stolen.
     ///
-    /// Messages must match all of the specified filters.
     /// Cannot be an empty list.
+    ///
+    /// Example:
+    /// ```json
+    /// {
+    ///   "all_of": [
+    ///     { "header": "x-user: my-user$" },
+    ///     { "path": "^/api/v1/my-endpoint" }
+    ///   ]
+    /// }
+    /// ```
     pub all_of: Option<Vec<InnerFilter>>,
 
-    /// #### feature.network.incoming.http_filter.any_of {#feature-network-incoming-http_filter-any_of}
+    /// ##### feature.network.incoming.http_filter.any_of {#feature-network-incoming-http_filter-any_of}
+    ///
+    /// An array of HTTP filters.
+    ///
+    /// Each inner filter specifies either header or path regex.
+    /// Requests must match at least one of the filters to be stolen.
     ///
-    /// Messages must match any of the specified filters.
     /// Cannot be an empty list.
+    ///
+    /// Example:
+    /// ```json
+    /// {
+    ///   "any_of": [
+    ///     { "header": "^x-user: my-user$" },
+    ///     { "path": "^/api/v1/my-endpoint" }
+    ///   ]
+    /// }
+    /// ```
     pub any_of: Option<Vec<InnerFilter>>,
 
     /// ##### feature.network.incoming.http_filter.ports {#feature-network-incoming-http_filter-ports}
diff --git a/mirrord/config/src/lib.rs b/mirrord/config/src/lib.rs
index a191975f752..0f4af006d68 100644
--- a/mirrord/config/src/lib.rs
+++ b/mirrord/config/src/lib.rs
@@ -1,6 +1,8 @@
 #![feature(slice_concat_trait)]
 #![feature(iterator_try_collect)]
 #![warn(clippy::indexing_slicing)]
+#![deny(unused_crate_dependencies)]
+
 //! <!--${internal}-->
 //! To generate the `mirrord-schema.json` file see
 //! `tests::check_schema_file_exists_and_is_valid_or_create_it`.
diff --git a/mirrord/console/src/lib.rs b/mirrord/console/src/lib.rs
index c629f808de9..c0f20214052 100644
--- a/mirrord/console/src/lib.rs
+++ b/mirrord/console/src/lib.rs
@@ -1,4 +1,15 @@
 #![warn(clippy::indexing_slicing)]
+#![deny(unused_crate_dependencies)]
+
+/// Silences `deny(unused_crate_dependencies)`.
+///
+/// These dependencies are only used in the console binary.
+#[cfg(feature = "binary")]
+mod binary_deps {
+    use tokio as _;
+    use tracing as _;
+    use tracing_subscriber as _;
+}
 
 #[cfg(feature = "async-logger")]
 pub mod async_logger;
diff --git a/mirrord/intproxy/Cargo.toml b/mirrord/intproxy/Cargo.toml
index 1c9cf9ecc75..ede6a260c02 100644
--- a/mirrord/intproxy/Cargo.toml
+++ b/mirrord/intproxy/Cargo.toml
@@ -20,7 +20,7 @@ workspace = true
 
 [dependencies]
 mirrord-config = { path = "../config" }
-mirrord-kube = { path = "../kube" }
+mirrord-kube = { path = "../kube", features = ["portforward"] }
 mirrord-operator = { path = "../operator", features = ["client"] }
 mirrord-protocol = { path = "../protocol" }
 mirrord-intproxy-protocol = { path = "./protocol", features = ["codec-async"] }
diff --git a/mirrord/intproxy/src/agent_conn.rs b/mirrord/intproxy/src/agent_conn.rs
index 5a2c47eaa95..1d982778411 100644
--- a/mirrord/intproxy/src/agent_conn.rs
+++ b/mirrord/intproxy/src/agent_conn.rs
@@ -161,7 +161,7 @@ impl AgentConnection {
                     .map_err(AgentConnectionError::Kube)?;
 
                 let stream = k8s_api
-                    .create_connection(connect_info.clone())
+                    .create_connection_portforward(connect_info.clone())
                     .await
                     .map_err(AgentConnectionError::Kube)?;
 
diff --git a/mirrord/intproxy/src/lib.rs b/mirrord/intproxy/src/lib.rs
index d9f85f64f55..7dd396c9eb0 100644
--- a/mirrord/intproxy/src/lib.rs
+++ b/mirrord/intproxy/src/lib.rs
@@ -1,5 +1,6 @@
 #![feature(map_try_insert, let_chains)]
 #![warn(clippy::indexing_slicing)]
+#![deny(unused_crate_dependencies)]
 
 use std::{collections::HashMap, time::Duration};
 
diff --git a/mirrord/kube/Cargo.toml b/mirrord/kube/Cargo.toml
index c0b48600b2c..c6179ea90ec 100644
--- a/mirrord/kube/Cargo.toml
+++ b/mirrord/kube/Cargo.toml
@@ -18,7 +18,12 @@ workspace = true
 
 [features]
 default = []
+# Enables connecting to the agent pod with plain TCP.
 incluster = []
+# Enables connecting to the agent pod with kube's portforwarder.
+portforward = [
+    "dep:tokio-retry"
+]
 
 [dependencies]
 mirrord-config = { path = "../config"}
@@ -27,7 +32,6 @@ mirrord-protocol = { path = "../protocol" }
 
 actix-codec.workspace = true
 async-stream = "0.3"
-bytes.workspace = true
 futures.workspace = true
 k8s-openapi.workspace = true
 kube.workspace = true
@@ -39,12 +43,7 @@ shellexpand = "3"
 thiserror.workspace = true
 tokio.workspace = true
 tracing.workspace = true
-tokio-retry = "0.3"
-pin-project-lite = "0.2"
+tokio-retry = { version = "0.3", optional = true }
 
 [dev-dependencies]
-base64.workspace = true
-http-body.workspace = true
-hyper.workspace = true
 rstest.workspace = true
-tower.workspace = true
diff --git a/mirrord/kube/src/api/kubernetes.rs b/mirrord/kube/src/api/kubernetes.rs
index fabd3dcaa9c..15ac4f86f94 100644
--- a/mirrord/kube/src/api/kubernetes.rs
+++ b/mirrord/kube/src/api/kubernetes.rs
@@ -30,7 +30,7 @@ use crate::{
     error::{KubeApiError, Result},
 };
 
-#[cfg(not(feature = "incluster"))]
+#[cfg(feature = "portforward")]
 pub mod portforwarder;
 pub mod rollout;
 pub mod seeker;
@@ -142,8 +142,8 @@ impl KubernetesAPI {
     }
 
     /// Connects to the agent using kube's [`Api::portforward`].
-    #[cfg(not(feature = "incluster"))]
-    pub async fn create_connection(
+    #[cfg(feature = "portforward")]
+    pub async fn create_connection_portforward(
         &self,
         connect_info: AgentKubernetesConnectInfo,
     ) -> Result<Box<dyn UnpinStream>> {
@@ -268,9 +268,9 @@ impl KubernetesAPI {
     }
 }
 
-/// Trait for IO streams returned from [`KubernetesAPI::create_connection`].
+/// Trait for IO streams returned from [`KubernetesAPI::create_connection_portforward`].
 /// It's here only to group the exisiting traits we actually need and return a `Box<dyn ...>`
-#[cfg(not(feature = "incluster"))]
+#[cfg(feature = "portforward")]
 pub trait UnpinStream:
     tokio::io::AsyncRead + tokio::io::AsyncWrite + Unpin + Send + 'static
 {
@@ -278,7 +278,7 @@ pub trait UnpinStream:
 
 /// Any type that implements bidirectional IO and can be sent to a different [`tokio::task`] is good
 /// enough.
-#[cfg(not(feature = "incluster"))]
+#[cfg(feature = "portforward")]
 impl<T> UnpinStream for T where
     T: tokio::io::AsyncRead + tokio::io::AsyncWrite + Unpin + Send + 'static
 {
diff --git a/mirrord/kube/src/api/kubernetes/portforwarder.rs b/mirrord/kube/src/api/kubernetes/portforwarder.rs
index 09ac7291f3c..bd5e6d8c983 100644
--- a/mirrord/kube/src/api/kubernetes/portforwarder.rs
+++ b/mirrord/kube/src/api/kubernetes/portforwarder.rs
@@ -7,7 +7,6 @@ use std::{
 
 use k8s_openapi::api::core::v1::Pod;
 use kube::{Api, Client};
-use pin_project_lite::pin_project;
 use tokio::io::{AsyncRead, AsyncWrite, AsyncWriteExt};
 use tokio_retry::{
     strategy::{jitter, ExponentialBackoff},
@@ -19,13 +18,10 @@ use crate::{
     error::{KubeApiError, Result},
 };
 
-pin_project! {
-    /// A wrapper for [`AsyncRead`] & [`AsyncWrite`] that dosn't call shutdown from [`AsyncWrite`] api
-    /// but it is done manually with `manual_shutdown`
-    struct ManualShutdown<S> {
-        #[pin]
-        inner: S,
-    }
+/// A wrapper for [`AsyncRead`] & [`AsyncWrite`] that dosn't call shutdown from [`AsyncWrite`] api
+/// but it is done manually with `manual_shutdown`
+struct ManualShutdown<S> {
+    inner: S,
 }
 
 impl<S> ManualShutdown<S> {
@@ -45,31 +41,31 @@ where
 
 impl<S> AsyncRead for ManualShutdown<S>
 where
-    S: AsyncRead,
+    S: AsyncRead + Unpin,
 {
     fn poll_read(
         self: Pin<&mut Self>,
         cx: &mut Context<'_>,
         buf: &mut tokio::io::ReadBuf<'_>,
     ) -> Poll<Result<(), std::io::Error>> {
-        self.project().inner.poll_read(cx, buf)
+        Pin::new(&mut self.get_mut().inner).poll_read(cx, buf)
     }
 }
 
 impl<S> AsyncWrite for ManualShutdown<S>
 where
-    S: AsyncWrite,
+    S: AsyncWrite + Unpin,
 {
     fn poll_write(
         self: Pin<&mut Self>,
         cx: &mut Context<'_>,
         buf: &[u8],
     ) -> Poll<Result<usize, std::io::Error>> {
-        self.project().inner.poll_write(cx, buf)
+        Pin::new(&mut self.get_mut().inner).poll_write(cx, buf)
     }
 
     fn poll_flush(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Result<(), std::io::Error>> {
-        self.project().inner.poll_flush(cx)
+        Pin::new(&mut self.get_mut().inner).poll_flush(cx)
     }
 
     /// Does nothing, call `manual_shutdown` for actuall inner shutdown call
diff --git a/mirrord/kube/src/lib.rs b/mirrord/kube/src/lib.rs
index 27fd5c9fd5b..5f49fe785e0 100644
--- a/mirrord/kube/src/lib.rs
+++ b/mirrord/kube/src/lib.rs
@@ -1,15 +1,19 @@
 #![feature(let_chains)]
 #![feature(try_trait_v2)]
 #![warn(clippy::indexing_slicing)]
+#![deny(unused_crate_dependencies)]
 
 //! # Features
 //!
 //! ## `incluster`
 //!
-//! Turn this feature on if you want this code to be run from inside a Kubernetes cluster.
-//! It affects the way [`api::kubernetes::KubernetesAPI`] connects to created agents.
-//! From outside of the cluster, [`kube`]s port forwarding is used.
-//! From inside of the cluster, plain TCP connection is made.
+//! Turn this feature on if you want to connect to agent pods from within the cluster with a plain
+//! TCP connection.
+//!
+//! ## `portforward`
+//!
+//! Turn this feature on if you want to connect to agent pods from outside the cluster with port
+//! forwarding.
 
 pub mod api;
 pub mod error;
diff --git a/mirrord/layer/Cargo.toml b/mirrord/layer/Cargo.toml
index d46147b8482..ec615ed1f49 100644
--- a/mirrord/layer/Cargo.toml
+++ b/mirrord/layer/Cargo.toml
@@ -27,52 +27,46 @@ mirrord-intproxy-protocol = { path = "../intproxy/protocol", features = [
     "codec",
 ] }
 
-ctor = "0.2"
-libc.workspace = true
+base64.workspace = true
 bincode.workspace = true
-nix = { workspace = true, features = ["net", "process", "signal"] }
-tracing.workspace = true
-tracing-subscriber.workspace = true
+bytemuck = "1"
+ctor = "0.2"
+envfile.workspace = true
+errno = "0.3"
 frida-gum = { version = "0.15", features = ["auto-download"] }
+hashbrown = "0.15"
 hyper = { workspace = true }
-
-serde_json.workspace = true
-
-thiserror.workspace = true
+libc.workspace = true
+nix = { workspace = true, features = ["net", "process", "signal"] }
+null-terminated = "0.3"
 num-traits = "0.2"
-
 rand.workspace = true
-fancy-regex.workspace = true
 regex.workspace = true
-errno = "0.3"
+serde_json.workspace = true
 socket2.workspace = true
-bytemuck = "1"
-hashbrown = "0.15"
-exec.workspace = true
+thiserror.workspace = true
+tracing.workspace = true
+tracing-subscriber.workspace = true
+
+[target.'cfg(target_os = "linux")'.dependencies]
 syscalls = { version = "0.6", features = ["full"] }
-null-terminated = "0.3"
-base64.workspace = true
-envfile.workspace = true
 
 [target.'cfg(target_os = "macos")'.dependencies]
 mirrord-sip = { path = "../sip" }
+
+exec.workspace = true
 resolv-conf = "0.7"
 
 [dev-dependencies]
 mirrord-intproxy = { path = "../intproxy" }
-k8s-openapi.workspace = true
-chrono = { workspace = true, features = ["clock"] }
-http-body = { workspace = true }
+
+actix-codec.workspace = true
+futures.workspace = true
 rstest.workspace = true
 tempfile.workspace = true
-test-cdylib = "*"
-tower.workspace = true
-tokio = { workspace = true, features = ["rt", "net", "macros"] }
 tests = { path = "../../tests" }
-flaky_test = "0.2"
-futures.workspace = true
-actix-codec.workspace = true
-tokio-stream.workspace = true
+test-cdylib = "1"
+tokio = { workspace = true, features = ["rt", "net", "macros", "fs"] }
 
 [lib]
 crate-type = ["cdylib"]
diff --git a/mirrord/layer/src/debugger_ports.rs b/mirrord/layer/src/debugger_ports.rs
index f78520fa643..b465d3190a9 100644
--- a/mirrord/layer/src/debugger_ports.rs
+++ b/mirrord/layer/src/debugger_ports.rs
@@ -6,7 +6,6 @@ use std::{
 };
 
 use hyper::Uri;
-use tracing::{error, warn};
 
 /// Environment variable used to tell the layer that it should dynamically detect the local
 /// port used by the given debugger. Value passed through this variable should parse into
@@ -26,7 +25,7 @@ pub const MIRRORD_DETECT_DEBUGGER_PORT_ENV: &str = "MIRRORD_DETECT_DEBUGGER_PORT
 pub const MIRRORD_IGNORE_DEBUGGER_PORTS_ENV: &str = "MIRRORD_IGNORE_DEBUGGER_PORTS";
 
 /// The default port used by node's --inspect debugger from the
-/// [node doceumentation](https://nodejs.org/en/learn/getting-started/debugging#enable-inspector)
+/// [node documentation](https://nodejs.org/en/learn/getting-started/debugging#enable-inspector)
 pub const NODE_INSPECTOR_DEFAULT_PORT: u16 = 9229;
 
 /// Type of debugger which is used to run the user's processes.
@@ -269,9 +268,8 @@ impl DebuggerType {
         }.iter().filter_map(|addr| match addr.ip() {
             IpAddr::V4(Ipv4Addr::LOCALHOST) | IpAddr::V6(Ipv6Addr::LOCALHOST) => Some(addr.port()),
             other => {
-                warn!(
-                    "Debugger uses a remote socket address {:?}! This case is not yet handled properly.",
-                    other,
+                tracing::debug!(
+                    "Debugger uses a remote socket address {other}! This case is not yet handled properly.",
                 );
                 None
             }
@@ -300,58 +298,64 @@ pub enum DebuggerPorts {
 impl FromStr for DebuggerPorts {
     type Err = std::convert::Infallible;
 
+    /// Parses [`DebuggerPorts`] from a string.
+    /// The string should look like one of:
+    /// 1. `<port>`
+    /// 2. `<port1>-<port2>`
+    /// 3. Comma-separated sequence of previous two variants
     fn from_str(s: &str) -> Result<Self, Self::Err> {
-        // string looks like 'port1,port2,port3-portx,porty-portz'
-        let mut vec = vec![];
-        s.split(',')
-            .for_each(|s| {
-                let chunks = s
+        let vec = s
+            .split(',')
+            .filter_map(|entry| {
+                let chunks = entry
                     .split('-')
                     .map(u16::from_str)
                     .collect::<Result<Vec<_>, _>>()
-                    .inspect_err(|e| error!(
-                        "Failed to decode debugger port range from {} env variable: {}",
-                        MIRRORD_IGNORE_DEBUGGER_PORTS_ENV,
-                        e
-                    ))
-                    .ok().unwrap_or_default();
-                match *chunks.as_slice() {
-                    [p] => vec.push(Self::Single(p)),
-                    [p1, p2] if p1 <= p2 => vec.push(Self::FixedRange(p1..=p2)),
+                    .ok();
+
+                match chunks.as_deref() {
+                    Some(&[p]) => Some(Self::Single(p)),
+                    Some(&[p1, p2]) if p1 <= p2 => Some(Self::FixedRange(p1..=p2)),
                     _ => {
-                        error!(
-                            "Failed to decode debugger ports from {} env variable: expected a port or range of ports",
+                        tracing::debug!(
+                            full_variable = s,
+                            entry,
+                            "Failed to decode debugger ports entry from {} env variable",
                             MIRRORD_IGNORE_DEBUGGER_PORTS_ENV,
                         );
-                    },
-                };
-            });
-        if !vec.is_empty() {
-            Ok(Self::Combination(vec))
-        } else {
-            Ok(Self::None)
-        }
+                        None
+                    }
+                }
+            })
+            .collect::<Vec<_>>();
+
+        let result = match vec.len() {
+            0 => Self::None,
+            1 => vec.into_iter().next().unwrap(),
+            _ => Self::Combination(vec),
+        };
+
+        Ok(result)
     }
 }
 
 impl fmt::Display for DebuggerPorts {
+    /// Writes [`DebuggerPorts`] into the given [`fmt::Formatter`],
+    /// using format recognized by [`FromStr`] implementation.
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(
-            f,
-            "{}",
-            match self {
-                DebuggerPorts::Single(port) => port.to_string(),
-                DebuggerPorts::FixedRange(range_inclusive) =>
-                    format!("{}-{}", range_inclusive.start(), range_inclusive.end()),
-                DebuggerPorts::Combination(vec) => {
-                    vec.iter()
-                        .map(ToString::to_string)
-                        .collect::<Vec<_>>()
-                        .join(",")
-                }
-                DebuggerPorts::None => String::default(),
+        match self {
+            Self::Single(port) => port.fmt(f),
+            Self::FixedRange(range) => write!(f, "{}-{}", range.start(), range.end()),
+            Self::Combination(vec) => {
+                let value = vec
+                    .iter()
+                    .map(ToString::to_string)
+                    .collect::<Vec<_>>()
+                    .join(",");
+                f.write_str(&value)
             }
-        )
+            Self::None => Ok(()),
+        }
     }
 }
 
@@ -366,10 +370,11 @@ impl DebuggerPorts {
             .ok()
             .and_then(|s| {
                 DebuggerType::from_str(&s)
-                    .inspect_err(|e| {
-                        error!(
-                            "Failed to decode debugger type from {} env variable: {}",
-                            MIRRORD_DETECT_DEBUGGER_PORT_ENV, e
+                    .inspect_err(|error| {
+                        tracing::debug!(
+                            error,
+                            "Failed to decode debugger type from {} env variable",
+                            MIRRORD_DETECT_DEBUGGER_PORT_ENV,
                         )
                     })
                     .ok()
diff --git a/mirrord/layer/src/lib.rs b/mirrord/layer/src/lib.rs
index 4530124f026..ce354494737 100644
--- a/mirrord/layer/src/lib.rs
+++ b/mirrord/layer/src/lib.rs
@@ -9,6 +9,7 @@
 #![feature(vec_into_raw_parts)]
 #![allow(rustdoc::private_intra_doc_links)]
 #![warn(clippy::indexing_slicing)]
+#![deny(unused_crate_dependencies)]
 
 //! Loaded dynamically with your local process.
 //!
@@ -100,6 +101,20 @@ use crate::{
     load::LoadType,
 };
 
+/// Silences `deny(unused_crate_dependencies)`.
+///
+/// These dependencies are only used in integration tests.
+#[cfg(test)]
+mod integration_tests_deps {
+    use actix_codec as _;
+    use futures as _;
+    use mirrord_intproxy as _;
+    use tempfile as _;
+    use test_cdylib as _;
+    use tests as _;
+    use tokio as _;
+}
+
 mod common;
 mod debugger_ports;
 mod detour;
diff --git a/mirrord/macros/src/lib.rs b/mirrord/macros/src/lib.rs
index cb329dc9e7c..f7c4d872a7c 100644
--- a/mirrord/macros/src/lib.rs
+++ b/mirrord/macros/src/lib.rs
@@ -1,3 +1,5 @@
+#![deny(unused_crate_dependencies)]
+
 extern crate proc_macro;
 
 use proc_macro::TokenStream;
diff --git a/mirrord/operator/Cargo.toml b/mirrord/operator/Cargo.toml
index 98145e1e836..8f4e8a407e6 100644
--- a/mirrord/operator/Cargo.toml
+++ b/mirrord/operator/Cargo.toml
@@ -18,7 +18,6 @@ workspace = true
 
 [features]
 default = []
-license-fetch = ["dep:reqwest"]
 client = [
   "crd",
   "dep:base64",
@@ -34,6 +33,7 @@ client = [
   "dep:mirrord-progress",
   "dep:mirrord-protocol",
   "dep:rand",
+  "dep:tokio",
   "dep:tokio-tungstenite",
   "dep:tracing",
 ]
@@ -41,8 +41,9 @@ crd = [
   "dep:k8s-openapi",
   "dep:kube",
   "dep:mirrord-config",
-  "dep:tokio",
-  "dep:serde_json"
+  "dep:semver",
+  "dep:serde_json",
+  "dep:thiserror",
 ]
 setup = ["crd", "dep:serde_yaml"]
 
@@ -66,13 +67,12 @@ k8s-openapi = { workspace = true, optional = true }
 kube = { workspace = true, features = ["derive", "ws"], optional = true }
 futures = { workspace = true, optional = true }
 rand = { workspace = true, optional = true }
-reqwest = { workspace = true, default-features = false, features = ["blocking", "json", "rustls-tls-native-roots"], optional = true }
 schemars = { workspace = true, features = ["chrono"] }
+semver = { workspace = true, features = ["serde"], optional = true }
 serde.workspace = true
 serde_json = { workspace = true, optional = true }
 serde_yaml = { workspace = true, optional = true }
-thiserror.workspace = true
-semver = { workspace = true, features = ["serde"] }
+thiserror = { workspace = true, optional = true }
 tokio = { workspace = true, optional = true }
 tokio-tungstenite = { workspace = true, optional = true }
 tracing = { workspace = true, optional = true }
diff --git a/mirrord/operator/src/lib.rs b/mirrord/operator/src/lib.rs
index f8f47f6eb5a..42dd7d2b430 100644
--- a/mirrord/operator/src/lib.rs
+++ b/mirrord/operator/src/lib.rs
@@ -1,6 +1,7 @@
 #![feature(let_chains)]
 #![feature(try_blocks)]
 #![warn(clippy::indexing_slicing)]
+#![deny(unused_crate_dependencies)]
 
 #[cfg(feature = "client")]
 pub mod client;
diff --git a/mirrord/progress/src/lib.rs b/mirrord/progress/src/lib.rs
index 8fd22dd02d7..bd586aab955 100644
--- a/mirrord/progress/src/lib.rs
+++ b/mirrord/progress/src/lib.rs
@@ -1,3 +1,5 @@
+#![deny(unused_crate_dependencies)]
+
 use std::{collections::HashSet, time::Duration};
 
 use enum_dispatch::enum_dispatch;
diff --git a/mirrord/protocol/Cargo.toml b/mirrord/protocol/Cargo.toml
index fda199ceac2..70f33186ba1 100644
--- a/mirrord/protocol/Cargo.toml
+++ b/mirrord/protocol/Cargo.toml
@@ -29,7 +29,6 @@ hyper = { workspace = true, features = ["client"] }
 http-serde = "2"
 http-body-util = { workspace = true }
 fancy-regex = { workspace = true }
-libc.workspace = true
 socket2.workspace = true
 semver = { workspace = true, features = ["serde"] }
 tokio-stream.workspace = true
@@ -38,4 +37,5 @@ tokio.workspace = true
 mirrord-macros = { path = "../macros" }
 
 [target.'cfg(target_os = "linux")'.dependencies]
+libc.workspace = true
 nix = { workspace = true, features = ["fs"] }
diff --git a/mirrord/protocol/src/lib.rs b/mirrord/protocol/src/lib.rs
index 501efdb3624..e8f7b651184 100644
--- a/mirrord/protocol/src/lib.rs
+++ b/mirrord/protocol/src/lib.rs
@@ -1,6 +1,7 @@
 #![feature(const_trait_impl)]
 #![feature(io_error_more)]
 #![warn(clippy::indexing_slicing)]
+#![deny(unused_crate_dependencies)]
 
 pub mod body_chunks;
 pub mod codec;
diff --git a/mirrord/sip/Cargo.toml b/mirrord/sip/Cargo.toml
index 52e07a74c26..4f9e740abd3 100644
--- a/mirrord/sip/Cargo.toml
+++ b/mirrord/sip/Cargo.toml
@@ -16,7 +16,7 @@ edition.workspace = true
 [lints]
 workspace = true
 
-[dependencies]
+[target.'cfg(target_os = "macos")'.dependencies]
 # we don't like upstream apple-platform-rs because it depends on RSA which has an open CVE.
 apple-codesign = { git = "https://github.com/metalbear-co/apple-platform-rs-mini", version = "0.27", default-features = false }
 object = "0.36"
@@ -28,5 +28,5 @@ thiserror.workspace = true
 which.workspace = true
 
 
-[dev-dependencies]
+[target.'cfg(target_os = "macos")'.dev-dependencies]
 tempfile.workspace = true
diff --git a/mirrord/sip/src/lib.rs b/mirrord/sip/src/lib.rs
index fd3b92611dc..80c4455d7b9 100644
--- a/mirrord/sip/src/lib.rs
+++ b/mirrord/sip/src/lib.rs
@@ -1,6 +1,7 @@
 #![feature(iter_intersperse)]
 #![warn(clippy::indexing_slicing)]
 #![cfg(target_os = "macos")]
+#![deny(unused_crate_dependencies)]
 
 mod codesign;
 mod error;
diff --git a/mirrord/vpn/Cargo.toml b/mirrord/vpn/Cargo.toml
index 848147c645d..4fe9e405c99 100644
--- a/mirrord/vpn/Cargo.toml
+++ b/mirrord/vpn/Cargo.toml
@@ -23,7 +23,6 @@ futures.workspace = true
 k8s-openapi.workspace = true
 kube.workspace = true
 ipnet.workspace = true
-paste = "1"
 pnet_packet = "0.35"
 semver.workspace = true
 serde_yaml.workspace = true
diff --git a/mirrord/vpn/src/lib.rs b/mirrord/vpn/src/lib.rs
index 7180a083663..13392894dfd 100644
--- a/mirrord/vpn/src/lib.rs
+++ b/mirrord/vpn/src/lib.rs
@@ -1,5 +1,6 @@
 #![feature(concat_idents)]
 #![feature(try_blocks)]
+#![deny(unused_crate_dependencies)]
 
 #[cfg(not(target_os = "macos"))]
 pub mod linux;