chore: release alkhttp 0.5.0

- version bump 0.4.1 -> 0.5.0 (minor per the dep-wave convention:
  0.3.0 rode alkcall 0.6.0, 0.4.0 rode alkcall 0.7.0)
- README usage snippet 0.4.1 -> 0.5.0
- changelog: cut [0.5.0] with the alkcall 0.8.0 consumption under
  Changed — the additive-only audit (reply fields, relay/hub-leg,
  flavor-form discovery) and the one ride-through discovery change
  (explicit channel_open_alpn for non-standard open-op names)

Verification: cargo test/clippy/fmt/doc green in the preceding deps
commit; no source change in this commit

CHANGELOG.md

@@ -6,6 +6,34 @@ this crate adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.5.0] — 2026-09-18
+
+### Changed
+
+- **`alkcall` dependency bumped to 0.8.0** (review 008's remediation
+  wave: the graduation upstream asks + the in-tree channel relay). No
+  code change in this crate — alkcall 0.8.0 is additive on the
+  call-plane JSON and the registry seams, and none of its new surfaces
+  are constructed here: this crate builds no `Establishment` reply
+  fields (the WS ferry passes `Option<OpenEstablisher>` through
+  unchanged; reply-field projection is an establisher-supplier
+  feature), imports no marked specs through `from_call` (the
+  `from_wss` operation filter excludes the protocol-session ops; any
+  domain op the remote serves imports as a forwarding bundle exactly
+  as before), and consumes neither `ChannelRelay` nor
+  `HubLegImports`/`HubLegTemplate` (hub-leg assembly remains the
+  consumer's concern at the assembly layer). One ride-through visible
+  on this crate's discovery surface: for a deployment's
+  `with_ws_openable_alpns` open-op specs whose names are not standard
+  `channels/<seg>/(sub|pub)` shapes, the served `services/list` /
+  `services/schema` output now carries an explicit
+  `channel_open_alpn` string alongside the boolean marker (alkcall
+  0.8.0's U-1, ADR-047 amendment 3) — so hubs relaying through a
+  `from_call` import of those ops reconstruct the marker instead of
+  seeing plain forwarding stubs. Standard-shape open-op names stay
+  byte-stable. Minor bump per the dep-wave convention (0.3.0 rode
+  alkcall 0.6.0; 0.4.0 rode 0.7.0).
+
 ## [0.4.1] — 2026-09-10
 
 ### Changed

Cargo.lock

@@ -27,9 +27,9 @@ dependencies = [
 
 [[package]]
 name = "alkcall"
-version = "0.7.1"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac26db919a1db9d72910ead8741af683bedefc625631028194b5f5e1dbd63cb6"
+checksum = "8695d47cee5b5a5fe68471f04a505bc257a7e7ed9e64d827de33ff83adf4db12"
 dependencies = [
  "async-trait",
  "bytes",
@@ -48,7 +48,7 @@ dependencies = [
 
 [[package]]
 name = "alkhttp"
-version = "0.4.1"
+version = "0.5.0"
 dependencies = [
  "alkcall",
  "arc-swap",
@@ -1485,7 +1485,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1860,7 +1860,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2679,7 +2679,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "alkhttp"
-version = "0.4.1"
+version = "0.5.0"
 edition = "2021"
 rust-version = "1.88"
 license = "MIT OR Apache-2.0"
@@ -42,7 +42,7 @@ h2 = ["server", "dep:hyper", "hyper-util/http2", "hyper/http2"]
 http1 = ["server", "dep:hyper", "hyper-util/http1", "hyper/http1"]
 
 [dependencies]
-alkcall = { version = "0.7", features = ["gateway"] }
+alkcall = { version = "0.8", features = ["gateway"] }
 arc-swap = { version = "1", optional = true }
 axum = { version = "0.8", optional = true, features = ["ws"] }
 bytes = "1"

README.md

@@ -161,7 +161,7 @@ A lean single-side build takes `default-features = false` plus the side
 it needs:
 
 ```toml
-alkhttp = { version = "0.4.1", default-features = false, features = ["server"] }
+alkhttp = { version = "0.5.0", default-features = false, features = ["server"] }
 ```
 
 ## Security posture