deps: Bump vgi-rpc from 0.16.0 to 0.24.1

[dependabot]

Bumps vgi-rpc from 0.16.0 to 0.24.1.

Release notes

Sourced from vgi-rpc's releases.

v0.24.1

Added

• Installable @query-farm/vgi-rpc-iroh-browser WebAssembly package for browser vgi-rpc/arrow-mux/1 and iroh-http/2 clients, including the Haybarn SharedArrayBuffer adapter and custom or disabled relay selection.
• Shared C ABI libraries in every native release archive so managed-language packages can load the embedded Iroh transport at runtime as well as C and C++ consumers linking it statically.

v0.24.0

Added

• Provider-neutral peer identity and authentication composition for direct Iroh peers, Tailscale, trusted PROXY-v2 listeners, forwarded HTTP identity, and proxy-verified SPIFFE workloads.
• Native iroh:// Arrow-mux and httpi:// HTTP-over-Iroh clients, including the reusable vgi-iroh-transport core and stable vgi-iroh-cabi embedding surface.
• A narrow dual-protocol Iroh bridge for existing raw and HTTP VGI workers. It preserves cryptographic Iroh identity while leaving load balancing and authorization to the configured upstream deployment.
• Browser WebAssembly bindings and a Haybarn demonstration for raw Arrow mux and HTTP-over-Iroh. Generated bindings are exercised in Chrome, Firefox, and WebKit, with an explicit Apple Safari qualification path.
• Strict HTTP response-budget negotiation across unary calls and continuation turns, separating client acceptance, worker production, and hosting limits.

Changed

• The release workflow now builds relocatable C ABI archives for Linux, macOS, and Windows, validates them with installed-package consumer smoke tests, and publishes the typed native and browser Iroh crates in dependency order.

Fixed

• Iroh bridge admission, cancellation, shutdown, idle-connection, and drain behavior is bounded without expiring active raw streams.
• Forwarded Iroh and Tailnet evidence cannot bypass the configured trusted proxy boundary or silently downgrade invalid application credentials.

v0.24.0-rc.1

Added

• Provider-neutral peer identity and authentication composition for direct Iroh peers, Tailscale, trusted PROXY-v2 listeners, forwarded HTTP identity, and proxy-verified SPIFFE workloads.

... (truncated)

Changelog

Sourced from vgi-rpc's changelog.

[0.24.1] — 2026-09-04

Added

• Installable @query-farm/vgi-rpc-iroh-browser WebAssembly package for browser vgi-rpc/arrow-mux/1 and iroh-http/2 clients, including the Haybarn SharedArrayBuffer adapter and custom or disabled relay selection.
• Shared C ABI libraries in every native release archive so managed-language packages can load the embedded Iroh transport at runtime as well as C and C++ consumers linking it statically.

[0.24.0] — 2026-09-04

Added

• Provider-neutral peer identity and authentication composition for direct Iroh peers, Tailscale, trusted PROXY-v2 listeners, forwarded HTTP identity, and proxy-verified SPIFFE workloads.
• Native iroh:// Arrow-mux and httpi:// HTTP-over-Iroh clients, including the reusable vgi-iroh-transport core and stable vgi-iroh-cabi embedding surface.
• A narrow dual-protocol Iroh bridge for existing raw and HTTP VGI workers. It preserves cryptographic Iroh identity while leaving load balancing and authorization to the configured upstream deployment.
• Browser WebAssembly bindings and a Haybarn demonstration for raw Arrow mux and HTTP-over-Iroh. Generated bindings are exercised in Chrome, Firefox, and WebKit, with an explicit Apple Safari qualification path.
• Strict HTTP response-budget negotiation across unary calls and continuation turns, separating client acceptance, worker production, and hosting limits.

Changed

• The release workflow now builds relocatable C ABI archives for Linux, macOS, and Windows, validates them with installed-package consumer smoke tests, and publishes the typed native and browser Iroh crates in dependency order.

Fixed

• Iroh bridge admission, cancellation, shutdown, idle-connection, and drain behavior is bounded without expiring active raw streams.
• Forwarded Iroh and Tailnet evidence cannot bypass the configured trusted proxy boundary or silently downgrade invalid application credentials.

[0.23.3] — 2026-08-27

Fixed

• Subprocess clients can enforce a monotonic response deadline per RPC. An expired call poisons the connection so late pipe bytes cannot desynchronize a later call or return the client to a pool. Unix kills and reaps the worker's

... (truncated)

Commits

• b0a25a9 Make browser npm publishing idempotent
• 9e7dfb5 Release browser and shared Iroh artifacts
• 1ef39fb Release v0.24.0
• ad7c9e4 Test externalized responses over HTTPi
• 59d9c7c Mark release candidates as GitHub prereleases
• d9347af Patch local S3 dependency in release dry runs
• eac525f Prepare v0.24.0 release candidate
• a38130b Verify workspace crates in release dry runs
• 5a2f720 Complete Windows C ABI link contract
• f8eb579 Harden native C ABI release packaging
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)