chore: release alkhttp 0.4.1

- version bump 0.4.0 -> 0.4.1 (patch: the MSRV raise is a metadata
  change that breaks no downstream able to build the crate before)
- README usage snippet 0.4 -> 0.4.1
- changelog: cut [0.4.1] with the alkcall 0.7.1 consumption + the
  rust-version 1.85 -> 1.88 floor raise under Changed

Verification: cargo publish --dry-run --allow-dirty (cargo test/clippy/
fmt green in the preceding deps commit)

CHANGELOG.md

@@ -6,6 +6,26 @@ this crate adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.4.1] — 2026-09-10
+
+### Changed
+
+- **`rust-version` floor raised 1.85 → 1.88** (patch bump, no API change).
+  The 1.85 claim was already false at the dependency level: the resolved
+  lockfile pulls `icu_*` 2.x (MSRV 1.86 via `jsonschema` → `idna`) and —
+  since alkcall 0.7.1 — alkcall itself declares 1.88, so 1.85 toolchains
+  cannot build the tree regardless of what Cargo.toml declared. Raising
+  the floor to 1.88 aligns with the ecosystem MSRV decision (noq QUIC
+  path; recorded for alktls in OQ-TLS-08) and breaks no downstream that
+  could build the crate before. Verified: 1.88 toolchain `cargo test
+  --locked` + clippy `--all-targets -D warnings` clean; one 1.88 clippy
+  lint fixed (`uninlined_format_args` in a `forward.rs` test).
+
+- **`alkcall` dependency consumed at 0.7.1** (lockfile bump; the
+  `version = "0.7"` requirement already covered it). No code change
+  forced — alkcall 0.7.1's changes are its own MSRV-floor raise plus the
+  cf-006/cf-007 feature work already consumed in the 0.7.0 wave.
+
 ## [0.4.0] — 2026-09-07
 
 ### Changed

Cargo.lock

@@ -27,9 +27,9 @@ dependencies = [
 
 [[package]]
 name = "alkcall"
-version = "0.7.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5162a10144df65b03b887e30f77eb30d956ca1ca460a3f81b409128cbcae3199"
+checksum = "ac26db919a1db9d72910ead8741af683bedefc625631028194b5f5e1dbd63cb6"
 dependencies = [
  "async-trait",
  "bytes",
@@ -48,7 +48,7 @@ dependencies = [
 
 [[package]]
 name = "alkhttp"
-version = "0.4.0"
+version = "0.4.1"
 dependencies = [
  "alkcall",
  "arc-swap",
@@ -1485,7 +1485,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1860,7 +1860,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -2679,7 +2679,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]

Cargo.toml

@@ -1,8 +1,8 @@
 [package]
 name = "alkhttp"
-version = "0.4.0"
+version = "0.4.1"
 edition = "2021"
-rust-version = "1.85"
+rust-version = "1.88"
 license = "MIT OR Apache-2.0"
 description = "HTTP interface for the alk stack: serves HTTP/1.1 + HTTP/2 on standard ALPNs (with WebSocket upgrade carrying the channels protocol) and hosts the HTTP-backed call-protocol adapters"
 readme = "README.md"

README.md

@@ -161,7 +161,7 @@ A lean single-side build takes `default-features = false` plus the side
 it needs:
 
 ```toml
-alkhttp = { version = "0.4", default-features = false, features = ["server"] }
+alkhttp = { version = "0.4.1", default-features = false, features = ["server"] }
 ```
 
 ## Security posture

src/adapters/forward.rs

@@ -2125,8 +2125,7 @@ mod tests {
                     );
                     assert!(
                         !segments.iter().any(|s| s == "." || s == ".."),
-                        "value `{value:?}` must not leave lone dot segments: {:?}",
-                        segments
+                        "value `{value:?}` must not leave lone dot segments: {segments:?}"
                     );
                 }
                 Err(err) => {