fix(deps): bump crossbeam-epoch and spin to clear security audit

[Liohtml]

Fixes the weekly Security Audit failures (runs of 2026-07-13 and 2026-07-20) on the firmware workspace. Two new advisory-db entries were flagging firmware/Cargo.lock:

• crossbeam-epoch 0.9.18 → 0.9.20 — fixes RUSTSEC-2026-0204 (invalid pointer dereference in fmt::Pointer). Build-host-only dependency via embuild → globwalk → ignore → crossbeam-deque; never linked into the firmware binary.
• spin 0.9.8 → 0.9.9 — 0.9.8 was yanked on crates.io, which cargo audit --deny warnings treats as an error. Runtime dependency via serde-json-core → heapless 0.7; patch-level bump.

Verified with the same invocations the Security Audit workflow uses: cargo audit (with the workflow's ignore list) and cargo-deny check both pass; the Firmware · Build (esp32) CI job on this PR confirms the firmware still builds.

https://claude.ai/code/session_01Y6hLvGUUywUH6P3Szj7i4A

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• firmware/Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 91059198-952b-44f2-bce4-099e44f216e6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/security-checks-failed-0utu7n

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}