chore(deps): bump dependencies and reconcile supply-chain vetting via imports/trust - #51
Merged
Merged
Conversation
…etting
Cargo.toml/Cargo.lock: bump to latest semver-compatible versions across
the board (tokio 1.53.1, serde/serde_core/serde_derive 1.0.229,
serde_json 1.0.151, syn 3.0.2 (+2.0.119 transitively), clap 4.6.3,
futures family 0.3.33, anyhow 1.0.104, regex 1.13.1, uuid 1.24.0,
toml 1.1.3+spec-1.1.0, thiserror 2.0.19, and their transitive deps).
Supply-chain reconciliation, done properly instead of re-diffing crates
this org has already reviewed elsewhere:
- New import: skyllc-ai/UltraFastFileSearch's own audits.toml (public
repo, same org/author). That repo already carries 110+ audited
crates overlapping heavily with this workspace's dependency tree -
an exact-match futures 0.3.32->0.3.33 delta audit was sitting there
unused while this repo re-reviewed the same diff from scratch.
- New [[trusted.*]] wildcard-publisher entries for dtolnay (serde,
serde_core, serde_derive, serde_json, syn, anyhow, quote,
rustversion, zmij), epage (winnow), BurntSushi (bstr), and the
github:rust-lang/cc-rs trusted-publisher signature (cc) - all
already corroborated by multiple existing imports (mozilla, isrg,
bytecode-alliance) per cargo-vet's own `trust` suggestions. This is
the durable fix: every future routine release from these
maintainers is covered going forward, not just this bump.
- tokio/tokio-macros/mio/portable-atomic had no corroborating
multi-source trust (single-or-uncorroborated publisher, or no
existing import coverage) - reviewed by hand: tokio-macros/mio are
doc-only or additive Solaris/NuttX platform support (dead code for
this workspace's CI matrix); tokio's one real change is a Windows
console-handler initialization-ordering fix; portable-atomic's
x86_64/aarch64-relevant changes are a strict-provenance ptr.addr()
migration plus a fallback-path refactor, no new unsafe or capability.
- `cargo vet prune` removed exemptions now superseded by audits/trust.
Vet-Reviewed-Diff: tokio-macros@2.7.0->2.7.1
Vet-Reviewed-Diff: tokio@1.53.0->1.53.1
Vet-Reviewed-Diff: mio@1.2.1->1.2.2
Vet-Reviewed-Diff: portable-atomic@1.13.1->1.14.0
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Jul 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
cargo vetproperly instead of re-diffing crates already reviewed elsewhere:skyllc-ai/UltraFastFileSearch's ownsupply-chain/audits.toml(public, same org). That repo already carries 110+ audited crates overlapping this workspace's tree - a redundant re-review was caught live this session (an exact-matchfutures 0.3.32 -> 0.3.33delta audit sitting unused there while this repo hand-reviewed the same diff).[[trusted.*]]wildcard-publisher entries fordtolnay(serde/serde_core/serde_derive/serde_json/syn/anyhow/quote/rustversion/zmij),epage(winnow),BurntSushi(bstr), and thegithub:rust-lang/cc-rstrusted-publisher signature (cc) - all already corroborated by 2+ existing imports (mozilla/isrg/bytecode-alliance) percargo vet's owntrustsuggestions. This is the durable part: every future routine release from these maintainers is covered automatically, not just this bump.tokio/tokio-macros/mio/portable-atomichad no corroborating multi-source trust, so reviewed by hand (seeaudits.tomlnotes for each): mio/tokio-macros are doc-only or additive Solaris/NuttX platform support (dead code for this workspace's CI matrix); tokio's one real change is a Windows console-handler init-ordering fix; portable-atomic's x86_64/aarch64-relevant changes are a strict-provenanceptr.addr()migration with no new unsafe.cargo vet pruneremoved exemptions now superseded by the new audits/trust/imports.Test plan
cargo check --workspace --all-features- clean.cargo vet check-Vetting Succeeded (58 fully audited, 24 partially audited, 33 exempted).lint-fast+lint-pre-pushgates (incl.vet-audit-discipline,commit-signatures) passed locally.