chore(deps): bump mostro-core 0.10 to 0.13.1

[Catrya]

Bumps mostro-core from 0.10.0 to 0.13.1, bringing in the transport module (kind-14 NIP-44 direct messaging). This is the isolated dependency bump — PR #1 of 2 for the protocol v2 migration (spec 005-transport-v2-migration). The actual transport switch lands in the follow-up feat/transport-v2.

The app still speaks protocol v1 (gift wrap, kind 1059) after this PR; it compiles and tests pass but is not yet E2E-functional against the v2 node.

Changes

• rust/Cargo.toml / Cargo.lock — mostro-core = "0.13.1"
• rust/src/api/orders.rs — fix the only compile breakage in map_core_status: order::Status gains the additive WaitingTakerBond and WaitingMakerBond variants. Both map to None (anti-abuse bond is out of scope), with no wildcard arm so future Status variants keep forcing the match to be revisited.

Why straight to 0.13.1

The transport module exists only from 0.13.0; 0.12.1 lacks it and keeps PROTOCOL_VER = 1, so stepping through it adds no value. 0.13.1 is the latest patch.

Verification

• nip59 wrap/unwrap signatures and WrapOptions are unchanged across the range → gift-wrap path compiles and behaves identically.
• No transitive nostr-sdk bump (stays 0.44.1).
• cargo build ✓ · cargo test ✓ (81 passed) · cargo clippy ✓ (0 errors).
• No FRB regen — changes are internal to crate::api, signatures unchanged.

Scope

Out of scope (→ feat/transport-v2): the gift_wrap.rs wrap/unwrap switch, kind-14 subscriptions + author-pin, receive-handler changes. Peer/dispute chat stays on gift wrap throughout.

Summary by CodeRabbit

• Chores
  • Updated core dependencies to the latest stable version for improved system stability and security
  • Enhanced internal status handling for increased reliability

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3d024245-28ec-4520-b711-f6b17b37ac95

📥 Commits

Reviewing files that changed from the base of the PR and between 35f8e1f and ba8596b.

⛔ Files ignored due to path filters (1)

• rust/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• rust/Cargo.toml
• rust/src/api/orders.rs

---

Walkthrough

The mostro-core dependency is bumped from 0.10 to 0.13.1 in rust/Cargo.toml. In rust/src/api/orders.rs, map_core_status is updated to explicitly return None for the two new WaitingTakerBond and WaitingMakerBond status variants introduced in the upgraded crate.

Changes

mostro-core upgrade and status mapping

Layer / File(s)	Summary
Dependency bump and new status variant mapping rust/Cargo.toml, rust/src/api/orders.rs	mostro-core is upgraded from 0.10 to 0.13.1; map_core_status adds explicit None returns for WaitingTakerBond and WaitingMakerBond, preventing silent wildcard fallthrough for any future new variants.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

A hop, a skip, the version's new,
0.13.1 hops into view! 🐇
Two waiting bonds now mapped to None,
No wildcard wildcards — job well done.
The rabbit checks each status arm,
And keeps the match tree free from harm! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: bumping mostro-core dependency from 0.10 to 0.13.1, which is the primary change in the changeset.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/mostro-core-0.13

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[mostronatorcoder]

I reviewed the current head and I do not see a blocking issue.

What I checked:

• The dependency bump is isolated to mostro-core 0.13.1 plus the lockfile update.
• map_core_status now handles the additive WaitingTakerBond / WaitingMakerBond variants explicitly instead of weakening the match with a wildcard.
• Returning None for those bond-only states is coherent with the stated scope of this PR and preserves exhaustiveness for future upstream enum growth.
• I do not see another correctness regression introduced by the patch itself.

Approved on the current revision.

[ermeme]

Reviewed the current head. No blocking issues found: the dependency bump is isolated, and the new WaitingTakerBond / WaitingMakerBond cases are handled explicitly without weakening exhaustiveness.