Repository navigation
deps: fix RustSec advisories, take over cargo group, add advisories gate - #119
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The advisory configuration does not fail transitive unsound advisories despite claiming whole-graph enforcement.
1 open finding
What changed in this PR
Updates dependencies to address RustSec advisories, adds an advisory CI gate, and restricts workflow permissions.
Changes:
- Upgrades vulnerable and grouped Rust dependencies.
- Migrates comfy-table calls to its v8 API.
- Adds cargo-deny advisory checks and read-only workflow permissions.
| File | Description |
|---|---|
Cargo.toml |
Updates direct dependency versions. |
Cargo.lock |
Locks upgraded security and grouped dependencies. |
src/output.rs |
Adapts table styling to comfy-table v8. |
deny.toml |
Configures advisory policy. |
.github/workflows/ci.yml |
Adds the advisory gate and permissions. |
.github/workflows/publish-crate.yml |
Adds read-only permissions. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Table::load_preset; the four call sites insrc/output.rsnow useTable::load_style(presets::NOTHING), the v8 replacement (presets areTableStyleconstants now). Bump the cargo group with 13 updates #117 can be closed as superseded after this merges.advisoriesjob inci.ymlrunningcargo deny check advisories(EmbarkStudios/cargo-deny-actionpinned by SHA, v2.1.1) with adeny.tomlthat has no ignores. Dependabot only surfaced the rustls alert; this catches the rest.permissions: contents: readinci.ymlandpublish-crate.yml(closes the CodeQLactions/missing-workflow-permissionsalerts). Neither workflow usesGITHUB_TOKENfor writes; crates.io publish usesCARGO_REGISTRY_TOKEN.Merge order
Merge after #118 (github-actions group, touches the same two workflow files).
How it was tested
Rust 1.99,
CARGO_BUILD_JOBS=2:cargo deny check advisories(cargo-deny 0.20.2):main= 2 errors (RUSTSEC-2026-0258 h2, RUSTSEC-2026-0285 rustls); this branch =advisories ok.cargo fmt --check: clean.cargo clippy --all-targets -- -D warnings: clean.cargo test: 877 passed, 0 failed.cargo build --release,mcp --version->mcp 0.6.2;mcp --listin a pseudo-terminal renders the borderless table as before (header + row, no borders).actionlinton all workflows: clean.Not tested locally: Docker images (no Docker on the build box); the CI
dockerjob builds and smoke-tests both. Release Beta runs onmainafter merge.