Update rustls-webpki 0.103.9 → 0.103.10. Exempt 0.102.8 which is
pinned by libsql's transitive dependency on an older rustls chain.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* feat: add cargo-deny for supply chain safety
Add dependency auditing via cargo-deny to catch license violations,
security advisories, and untrusted sources. Integrates into CI as a
parallel job alongside clippy, and into the local quality gate script.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: use cargo-deny action in CI, improve quality gate script
- Use EmbarkStudios/cargo-deny-action@v2 instead of cargo install
for faster CI execution
- Fix quality_gate_strict.sh to check for cargo-deny availability
instead of suppressing stderr
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: add missing Unlicense and CDLA-Permissive-2.0 to license allowlist
Add Unlicense (used by aho-corasick, memchr, etc.) and
CDLA-Permissive-2.0 (used by webpki-roots) to prevent
cargo deny check from failing on the current dependency tree.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* chore: trigger CI after retargeting PR to staging
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: use valid cargo-deny v0.19 syntax for unmaintained advisories
The `unmaintained` field in [advisories] accepts "all", "workspace",
"transitive", or "none" — not "warn". Use "workspace" to flag
unmaintained direct dependencies without failing on transitive ones.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* chore: re-trigger CI after adding skip-regression-check label
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: migrate deny.toml [licenses] to version 2 format
Remove deprecated `unlicensed` and `default` fields, add `version = 2`.
In v2, all licenses are denied unless explicitly in the allow list,
making these fields redundant.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: ignore pre-existing advisories in deny.toml with justification
Add known RUSTSEC IDs to the ignore list so cargo-deny CI passes.
Each advisory is documented with mitigation context. Dependency
upgrades to resolve these should be tracked separately.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address PR review feedback for cargo-deny integration
- quality_gate_strict.sh: fail hard when cargo-deny is not installed
instead of silently skipping, and let set -e handle check failures
- deny.toml: remove empty [graph].targets so cargo-deny checks all
platforms instead of only the runner's default target
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(deny.toml): correct serde_yml advisory comment to reflect direct dependency
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: tighten clippy-windows check in roll-up job
Change from checking only `== "failure"` to checking
`!= "success" && != "skipped"`. This ensures any unexpected
result (e.g., cancelled) also blocks the merge, while still
allowing the expected "skipped" state for non-main PRs.
Addresses zmanian's review feedback on PR #834.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: cd to repo root in strict gate, deny wildcard versions
- quality_gate_strict.sh: add `cd` to repo root so the script works
when invoked from any working directory.
- deny.toml: change `wildcards = "allow"` to `"deny"` to catch `*`
version requirements in dependencies.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
