fix(deps): bump spin to 0.9.9 to clear yanked-crate warning

[chaliy]

What changed

spin moves 0.9.8 -> 0.9.9 in Cargo.lock, and the cargo-vet exemption is
repinned to match. No source changes, no API or behavior changes.

Why

spin 0.9.8 was yanked from crates.io, so cargo audit flagged it as a yanked
dependency. 0.9.9 is a semver-compatible patch release that still satisfies the
existing heapless 0.7 requirement, so only the lockfile moves — nothing else in
the graph re-resolves.

Found while sweeping the dependency tree for advisories. Everything else came back
clean: cargo audit reports 0 vulnerabilities (even with no --ignore flags),
and pnpm audit is clean across all five JS workspaces.

Before / After

Before:

Crate:     spin
Version:   0.9.8
Warning:   yanked

warning: 3 allowed warnings found

After:

warning: 2 allowed warnings found

The two remaining warnings are the pre-existing, already-triaged unmaintained
notices for atomic-polyfill (RUSTSEC-2023-0089) and proc-macro-error2
(RUSTSEC-2026-0173), both ignored in deny.toml.

Supply-chain check still passes with the repinned exemption:

$ cargo vet --locked
Vetting Succeeded (28 fully audited, 6 partially audited, 589 exempted)

Also verified locally: cargo fmt --check, cargo check --workspace --features http_client,ssh,sqlite, and cargo test --workspace --lib --features http_client,ssh,sqlite all pass.

Risk

• Low
• Lockfile-only patch bump of a transitive dependency (heapless 0.7 -> spin).
  spin 0.9.9 is the yank-replacement for 0.9.8 with the same dependency set
  (lock_api). Risk is limited to the embedded-Python path that pulls in
  heapless via postcard; the full CI matrix covers it.

Checklist

• Tests added or updated — n/a, no source change; existing suites re-run as verification
• Backward compatibility considered — no public surface affected

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	cab74c8	Commit Preview URL Branch Preview URL	Aug 10 2026, 09:25 AM