fix: resolve RUSTSEC-2023-0089 and RUSTSEC-2025-0141 advisories#161
Merged
unclesp1d3r merged 14 commits intomainfrom Mar 17, 2026
Merged
Conversation
Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
… tests Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
Raise the max command line argument length assertion from 8KB to 128KB in the property-based process tests. Real-world processes (language servers, AI tools, Java apps) regularly exceed the previous limit, causing false test failures on developer machines. Also apply mdformat auto-fix to docs/src/testing.md. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
dosubot
bot
added
the
size:L
Summary by CodeRabbit
WalkthroughAdds an MCP stdio server config, restructures Mergify into multi-queue rules, removes specific RUSTSEC ignores, bumps many Rust workspace dependencies, introduces Tessl-managed agent rules and tessl.json vendored manifest, and increases procmond test argument-size bounds with new regression seeds. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Comment |
Contributor
Merge ProtectionsYour pull request matches the following merge protections and will not be merged until they are valid. 🟠 CI must passWaiting checks:
|
dosubot
bot
added
dependencies
Contributor
|
Related Documentation 4 document(s) may need updating based on files changed in this PR: DaemonEye SECURITY
|
coderabbitai
bot
added
documentation
There was a problem hiding this comment.
Pull request overview
This PR primarily resolves RustSec advisory findings by adjusting dependency configuration and updating the lockfile, while also introducing several new AI/tooling configuration files and updating repo automation configuration.
Changes:
- Updated workspace dependencies (incl.
rand), adjustedpostcardfeatures to dropheapless/atomic-polyfill, and refreshedCargo.lock. - Removed stale RUSTSEC ignore entries from
deny.tomland updatedrandtrait imports to match the newrandAPI. - Adjusted a property-based test’s command-line argument length bound to reduce local flakiness; added multiple new tooling/config files (Tessl/MCP/Coderabbit) and rewrote
.mergify.yml.
Reviewed changes
Copilot reviewed 23 out of 26 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
Cargo.toml |
Bumps workspace dependency versions; disables postcard default features to drop vulnerable/unmaintained transitive deps. |
Cargo.lock |
Lockfile refresh reflecting new dependency graph (removes atomic-polyfill/heapless, adds new rand graph, etc.). |
deny.toml |
Removes RUSTSEC ignore list (now empty) after dependency tree cleanup. |
daemoneye-eventbus/src/task_distribution.rs |
Updates rand trait import to RngExt for random collector selection. |
collector-core/src/load_balancer.rs |
Updates rand trait import to RngExt for random load-balancer selection. |
procmond/tests/property_based_process_tests.rs |
Increases allowed per-arg command line length to reduce flaky property tests on dev machines. |
procmond/tests/property_based_process_tests.proptest-regressions |
Adds new regression seeds captured by proptest. |
docs/src/testing.md |
Minor workflow snippet formatting changes in docs. |
tessl.json |
Adds Tessl configuration / vendored skill dependencies. |
AGENTS.md |
Adds a Tessl-managed “Agent Rules” reference line. |
.tessl/RULES.md |
Introduces Tessl-managed rules index. |
.tessl/.gitignore |
Ignores Tessl tiles and RULES.md. |
.mcp.json |
Adds MCP server configuration for Tessl (tessl mcp start). |
.gitignore |
Adds ignore patterns for AI assistant artifacts (incl. Tessl tiles). |
.mergify.yml |
Rewrites Mergify configuration (merge queue, bot approvals, protections). |
.coderabbit.yaml |
Adds CodeRabbit configuration for automated reviews/tooling. |
.github/skills/.gitignore |
Ignores Tessl-managed skill artifacts under .github/skills. |
.gemini/skills/.gitignore |
Ignores Tessl-managed skill artifacts under .gemini/skills. |
.gemini/settings.json |
Adds Gemini MCP configuration for Tessl. |
.cursor/skills/.gitignore |
Ignores Tessl-managed skill artifacts under .cursor/skills. |
.cursor/rules/.gitignore |
Ignores Tessl-managed Cursor rule artifacts. |
.cursor/mcp.json |
Adds Cursor MCP configuration for Tessl. |
.codex/skills/.gitignore |
Ignores Tessl-managed skill artifacts under .codex/skills. |
.codex/config.toml |
Adds Codex MCP configuration for Tessl. |
.claude/skills/.gitignore |
Ignores Tessl-managed skill artifacts under .claude/skills. |
.agents/skills/.gitignore |
Ignores Tessl-managed skill artifacts under .agents/skills. |
Comment on lines
+67
to
+80
| - name: Auto-approve dosubot PRs | ||
| conditions: | ||
| - base = main | ||
| - author = dosubot[bot] | ||
| actions: | ||
| review: | ||
| type: APPROVE | ||
| message: Automatically approved by Mergify | ||
|
|
||
| - name: Keep bot PRs up to date with main | ||
| conditions: | ||
| - base = main | ||
| - -conflict | ||
| - -draft | ||
| - or: | ||
| - author = dependabot[bot] | ||
| - author = dosubot[bot] | ||
| - head ~= ^release-plz- | ||
| actions: | ||
| update: {} | ||
| - name: Auto-approve dependabot PRs | ||
| conditions: | ||
| - base = main | ||
| - author = dependabot[bot] | ||
| actions: |
- Remove RULES.md from .tessl/.gitignore (file is tracked, ignore was contradictory) - Rewrite AGENTS.md directive token to normal prose - Add -draft condition to bot auto-approve rules in Mergify - Restore 3-commit outdated PR threshold in Mergify Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
The @ directive token is intentional for Tessl-managed rules. Reverts the incorrect review fix. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Warning
CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.
Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.mergify.yml:
- Around line 5-13: The dosubot queue is missing a file-scoped guard allowing
non-workflow PRs to bypass full CI; update the dosubot queue_conditions to
include the same file restriction used by dependabot-workflows (e.g., "-files ~=
^(?!\\.github/workflows/)") so it only matches workflow-only changes, and also
add that same file guard to the lint-only protection condition that currently
unconditionally accepts "author = dosubot[bot]"; locate and modify the "dosubot"
queue block and the lint-only protection rule (where "author = dosubot[bot]" is
set) to include the file-pattern condition so non-workflow dosubot PRs will
route to full-CI instead of bypassing it.
- Around line 52-61: The default queue declaration named "default" is missing
queue_conditions that enforce admission-time guards; add a queue_conditions
block to the "default" queue mirroring the bot queues by requiring base = main
and label != do-not-merge so PRs targeting non-main branches or labeled
do-not-merge cannot be enqueued; keep the existing merge_conditions intact
(merge_method and merge_conditions) and ensure the new queue_conditions use the
same syntax as in the dosubot/dependabot queues.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: a36b0470-9e1d-484b-9e94-cee46109e916
⛔ Files ignored due to path filters (14)
.agents/skills/.gitignoreis excluded by none and included by none.claude/skills/.gitignoreis excluded by none and included by none.codex/config.tomlis excluded by none and included by none.codex/skills/.gitignoreis excluded by none and included by none.cursor/mcp.jsonis excluded by none and included by none.cursor/rules/.gitignoreis excluded by none and included by none.cursor/skills/.gitignoreis excluded by none and included by none.gemini/settings.jsonis excluded by none and included by none.gemini/skills/.gitignoreis excluded by none and included by none.gitignoreis excluded by none and included by none.tessl/.gitignoreis excluded by none and included by none.tessl/RULES.mdis excluded by none and included by noneCargo.lockis excluded by!**/*.lockand included by nonedaemoneye-eventbus/src/task_distribution.rsis excluded by none and included by none
📒 Files selected for processing (12)
.coderabbit.yaml.github/skills/.gitignore.mcp.json.mergify.ymlAGENTS.mdCargo.tomlcollector-core/src/load_balancer.rsdeny.tomldocs/src/testing.mdprocmond/tests/property_based_process_tests.proptest-regressionsprocmond/tests/property_based_process_tests.rstessl.json
Comment on lines
+52
to
+61
| - name: default | ||
| merge_method: squash | ||
| merge_conditions: | ||
| - check-success = quality | ||
| - check-success = test | ||
| - "check-success = test-cross-platform (macos-15, macOS)" | ||
| - "check-success = test-cross-platform (windows-2022, Windows)" | ||
| - "check-success = test-cross-platform (ubuntu-22.04, Linux)" | ||
| - check-success = coverage | ||
| - check-success = DCO |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
find . -name ".mergify.yml" -type fRepository: EvilBit-Labs/DaemonEye
Length of output: 80
🏁 Script executed:
cat ./.mergify.ymlRepository: EvilBit-Labs/DaemonEye
Length of output: 5957
🌐 Web query:
Mergify queue_conditions admission merge_conditions timing documentation
💡 Result:
-
queue_conditions(admission / enqueueing): These conditions are evaluated to decide whether a PR can be accepted into a merge queue. Ifautoqueue: true, the PR is added as soon as it matchesqueue_conditions(you can even omit CI fromqueue_conditionsto “queue early”). If you use thequeueaction, the PR still must match the queue rule’squeue_conditionsto actually enter the queue. [1], [2] -
merge_conditions(merge gate at the front): These conditions are evaluated to decide whether a queued PR can be merged once it reaches the front of the queue (typically stricter: full CI, approvals, etc.). For merge-queue “draft/temporary PR” operation, check-related merge conditions are evaluated against the temporary PR, not the original. [1] -
Timing-related knobs/fields (queue processing):
batch_max_wait_time: how long Mergify may wait to form a batch (default shown as 30s). [1]checks_timeout: how long the queue waits for pending checks before dequeueing (min 60s). [1]- Condition attributes you can use/inspect include
queued-atandqueue-merge-started-attimestamps. [3]
Sources:
[1] Mergify Docs — “Using Queue Rules” (queue_rules, queue_conditions vs merge_conditions, autoqueue, timing options) (docs.mergify.com)
[2] Mergify Docs — “Queue” action (still must satisfy queue_conditions; name parameter behavior) (docs.mergify.com)
[3] Mergify Docs — “Conditions” reference (queued-at, queue-merge-started-at) (docs.mergify.com)
Citations:
- 1: https://docs.mergify.com/merge-queue/rules/
- 2: https://docs.mergify.com/workflow/actions/queue/
- 3: https://docs.mergify.com/configuration/conditions/
Add queue_conditions to the default queue to enforce base-branch and merge-policy guards.
The default queue lacks queue_conditions, unlike all three bot queues (dosubot, dependabot-workflows, dependabot), which each enforce base = main and label != do-not-merge at admission time. Without these guards, /queue can admit PRs against non-main branches or flagged with do-not-merge. Mergify evaluates queue_conditions during enqueueing and merge_conditions only at the front—so these admission controls are essential for policy consistency. Copy the same base and label guards to the default queue for operator safety.
Suggested fix
- name: default
merge_method: squash
+ queue_conditions:
+ - base = main
+ - label != do-not-merge
merge_conditions:
- check-success = quality
- check-success = test
- "check-success = test-cross-platform (macos-15, macOS)"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - name: default | |
| merge_method: squash | |
| merge_conditions: | |
| - check-success = quality | |
| - check-success = test | |
| - "check-success = test-cross-platform (macos-15, macOS)" | |
| - "check-success = test-cross-platform (windows-2022, Windows)" | |
| - "check-success = test-cross-platform (ubuntu-22.04, Linux)" | |
| - check-success = coverage | |
| - check-success = DCO | |
| - name: default | |
| merge_method: squash | |
| queue_conditions: | |
| - base = main | |
| - label != do-not-merge | |
| merge_conditions: | |
| - check-success = quality | |
| - check-success = test | |
| - "check-success = test-cross-platform (macos-15, macOS)" | |
| - "check-success = test-cross-platform (windows-2022, Windows)" | |
| - "check-success = test-cross-platform (ubuntu-22.04, Linux)" | |
| - check-success = coverage | |
| - check-success = DCO |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.mergify.yml around lines 52 - 61, The default queue declaration named
"default" is missing queue_conditions that enforce admission-time guards; add a
queue_conditions block to the "default" queue mirroring the bot queues by
requiring base = main and label != do-not-merge so PRs targeting non-main
branches or labeled do-not-merge cannot be enqueued; keep the existing
merge_conditions intact (merge_method and merge_conditions) and ensure the new
queue_conditions use the same syntax as in the dosubot/dependabot queues.
There was a problem hiding this comment.
Pull request overview
This PR resolves outstanding RustSec advisories by adjusting dependency feature flags and cleaning up cargo-deny advisory handling, alongside small API-migration and test-stability updates.
Changes:
- Remove the
atomic-polyfilladvisory path by disablingpostcarddefault features (keepingalloc) and update workspace dependencies/lockfile accordingly. - Update
randcall sites to theRngExttrait after therandupgrade. - Reduce CI noise/flakiness via a relaxed command-line argument length bound in property tests, plus assorted tooling/config/documentation updates.
Reviewed changes
Copilot reviewed 24 out of 27 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
Cargo.toml |
Updates workspace dependency versions and disables postcard default features to drop advisory-bearing transitive deps. |
Cargo.lock |
Reflects dependency graph changes (removes atomic-polyfill/heapless, upgrades crates, adds rand 0.10.0). |
deny.toml |
Removes advisory ignore list and sets ignore = [] to enforce “no ignored advisories”. |
collector-core/src/load_balancer.rs |
Migrates rand usage to RngExt for random_range. |
daemoneye-eventbus/src/task_distribution.rs |
Migrates rand usage to RngExt for random_range. |
procmond/tests/property_based_process_tests.rs |
Raises per-argument command-line length upper bound to reduce real-world flakiness. |
procmond/tests/property_based_process_tests.proptest-regressions |
Adds new regression seeds corresponding to the updated property tests. |
SECURITY.md |
Updates accepted-risk/advisory history and review dates to reflect resolved advisories. |
docs/src/testing.md |
mdformat-style tweak to the documented workflow_dispatch input example. |
.mergify.yml |
Reworks Mergify configuration to use merge queues and expands protections/automation logic. |
tessl.json |
Adds Tessl dependency configuration for vendored skill tiles. |
.tessl/RULES.md |
Adds Tessl-managed rules index pointing to tile rule/steering docs. |
.tessl/.gitignore |
Ignores Tessl-downloaded tiles directory. |
.mcp.json |
Adds MCP server configuration for Tessl integration. |
.gitignore |
Adds ignore rules for various AI assistant/tooling artifacts and Tessl tile directories. |
AGENTS.md |
Adds a pointer to Tessl-managed agent rules. |
.coderabbit.yaml |
Adds CodeRabbit review configuration for automated code review tooling. |
.github/skills/.gitignore |
Ignores Tessl-managed skill artifacts in GitHub skills directory. |
.gemini/skills/.gitignore |
Ignores Tessl-managed skill artifacts in Gemini skills directory. |
.gemini/settings.json |
Adds MCP server config for Gemini integration. |
.cursor/skills/.gitignore |
Ignores Tessl-managed skill artifacts in Cursor skills directory. |
.cursor/rules/.gitignore |
Ignores Tessl-managed Cursor rule artifacts. |
.cursor/mcp.json |
Adds MCP server config for Cursor integration. |
.codex/skills/.gitignore |
Ignores Tessl-managed skill artifacts in Codex skills directory. |
.codex/config.toml |
Adds MCP server config for Codex integration. |
.claude/skills/.gitignore |
Ignores Tessl-managed skill artifacts in Claude skills directory. |
.agents/skills/.gitignore |
Ignores Tessl-managed skill artifacts in agents skills directory. |
| } | ||
| }, | ||
| "cisco/software-security": { | ||
| "version": "1.2.5" |
There was a problem hiding this comment.
♻️ Duplicate comments (4)
.mergify.yml (4)
52-61:⚠️ Potential issue | 🟡 MinorMissing queue_conditions on default queue.
Unlike the bot queues which enforce
base = mainandlabel != do-not-mergeat admission time, thedefaultqueue has noqueue_conditions. This means/queuecan admit PRs targeting non-main branches or flaggeddo-not-merge—they'll only fail at merge time after wasting queue resources.Add admission guards:
- name: default merge_method: squash + queue_conditions: + - base = main + - label != do-not-merge merge_conditions:🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.mergify.yml around lines 52 - 61, The default queue block named "default" is missing queue_conditions, so add admission guards to the "default" queue to match the bot queues: include a queue_conditions entry that requires base = main and label != do-not-merge (i.e., ensure PR target branch is main and the PR does not have the do-not-merge label) so PRs are rejected at admission time rather than wasting queue resources.
146-151:⚠️ Potential issue | 🔴 CriticalLint-only protection accepts dosubot unconditionally.
The
orblock at line 147-148 matchesauthor = dosubot[bot]without the file guard that dependabot gets (lines 149-151). This means dosubot PRs touching source code satisfy only the lint check while dependabot PRs touching source code correctly require full CI.Apply symmetric file guards:
if: - base = main - or: - - author = dosubot[bot] + - and: + - author = dosubot[bot] + - "-files ~= ^(?!\\.github/workflows/)" - and: - author = dependabot[bot] - "-files ~= ^(?!\\.github/workflows/)"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.mergify.yml around lines 146 - 151, The or-block currently permits author = dosubot[bot] without the file guard that the author = dependabot[bot] branch has; add the same files protection (-files ~= ^(?!\\.github/workflows/)) under the author = dosubot[bot] branch so both rules require the file-pattern guard, keeping the existing structure of the or block and mirroring the dependabot entry.
5-13:⚠️ Potential issue | 🔴 CriticalSecurity bypass: dosubot queue lacks file-scope guard.
This queue admits any
dosubot[bot]PR with only thequalitycheck required for merge. Unlikedependabot-workflows(line 25), there's no-files ~= ^(?!\\.github/workflows/)restriction. Combined with auto-approval (lines 67-75) and exclusion from full CI (lines 124-125), dosubot can merge arbitrary code changes with only lint passing.Add the same file guard used by
dependabot-workflows:queue_conditions: - base = main - label != do-not-merge - author = dosubot[bot] + - "-files ~= ^(?!\\.github/workflows/)"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.mergify.yml around lines 5 - 13, The dosubot merge queue (name: dosubot) lacks the file-scope guard present on dependabot-workflows; add the same file-filter condition to the dosubot queue so it only auto-queues PRs that do not change arbitrary repo files (i.e. add the -files ~= ^(?!\\.github/workflows/) condition into the dosubot queue_conditions block), mirroring the dependabot-workflows configuration to prevent dosubot from merging arbitrary code changes.
67-75:⚠️ Potential issue | 🟠 MajorAuto-approval for dosubot lacks file restriction.
This rule unconditionally approves all
dosubot[bot]PRs regardless of what files they touch. Combined with the unguarded queue admission (lines 5-13), this creates an approval pipeline for non-workflow code changes that bypasses human review.Either scope the auto-approval to workflow-only changes:
- name: Auto-approve dosubot PRs conditions: - base = main - -draft - author = dosubot[bot] + - "-files ~= ^(?!\\.github/workflows/)"Or rely on queue-level file guards and remove this rule for dosubot entirely if the bot should never touch non-workflow files.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.mergify.yml around lines 67 - 75, The "Auto-approve dosubot PRs" Mergify rule currently approves any PR authored by dosubot[bot] unconditionally; update the rule (named "Auto-approve dosubot PRs") to either remove it entirely if dosubot must never approve non-workflow changes, or add a files condition restricting it to only workflow/CI files (e.g., add a condition such as "files~=(^\\.github/workflows/|^\\.github/)" or similar pattern) so the actions.review (type: APPROVE) only triggers for workflow-only changes; ensure you keep the author = dosubot[bot] condition and modify the conditions block accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In @.mergify.yml:
- Around line 52-61: The default queue block named "default" is missing
queue_conditions, so add admission guards to the "default" queue to match the
bot queues: include a queue_conditions entry that requires base = main and label
!= do-not-merge (i.e., ensure PR target branch is main and the PR does not have
the do-not-merge label) so PRs are rejected at admission time rather than
wasting queue resources.
- Around line 146-151: The or-block currently permits author = dosubot[bot]
without the file guard that the author = dependabot[bot] branch has; add the
same files protection (-files ~= ^(?!\\.github/workflows/)) under the author =
dosubot[bot] branch so both rules require the file-pattern guard, keeping the
existing structure of the or block and mirroring the dependabot entry.
- Around line 5-13: The dosubot merge queue (name: dosubot) lacks the file-scope
guard present on dependabot-workflows; add the same file-filter condition to the
dosubot queue so it only auto-queues PRs that do not change arbitrary repo files
(i.e. add the -files ~= ^(?!\\.github/workflows/) condition into the dosubot
queue_conditions block), mirroring the dependabot-workflows configuration to
prevent dosubot from merging arbitrary code changes.
- Around line 67-75: The "Auto-approve dosubot PRs" Mergify rule currently
approves any PR authored by dosubot[bot] unconditionally; update the rule (named
"Auto-approve dosubot PRs") to either remove it entirely if dosubot must never
approve non-workflow changes, or add a files condition restricting it to only
workflow/CI files (e.g., add a condition such as
"files~=(^\\.github/workflows/|^\\.github/)" or similar pattern) so the
actions.review (type: APPROVE) only triggers for workflow-only changes; ensure
you keep the author = dosubot[bot] condition and modify the conditions block
accordingly.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 09813ebd-34a0-4cee-924d-dd5d61f3c9ff
⛔ Files ignored due to path filters (1)
.tessl/.gitignoreis excluded by none and included by none
📒 Files selected for processing (2)
.mergify.ymlSECURITY.md
unclesp1d3r
deleted the
131-rustsec-2023-0089-atomic-polyfill-is-unmaintained
branch
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves all outstanding RUSTSEC advisories to achieve a clean
cargo deny check advisoriesandcargo audit— zero ignored advisories remaining.Impact: 27 files changed (+415, -230) | Risk Level: Low | Review Focus:
Cargo.toml,deny.toml, 2 source filesWhat Changed
Security Fixes (Primary Goal)
atomic-polyfillpostcarddefault features —heapless(which pulled inatomic-polyfill) was never usedbincodebincodewas never in the dependency treeKey change in
Cargo.toml:Dependency tree result:
atomic-polyfill— eliminatedheapless— eliminatedhash32— eliminatedstable_deref_trait— eliminatedSource Code Fixes
collector-core/src/load_balancer.rsrand::Rng→rand::RngExtrand0.9→0.10 movedrandom_rangetoRngExttraitdaemoneye-eventbus/src/task_distribution.rsrand::Rng→rand::RngExtprocmond/tests/property_based_process_tests.rsDependency Updates
26 crate version bumps (click to expand)
Config & Tooling (non-functional)
.gitignorefiles for tessl-managed skill directoriesdocs/src/testing.mdRisk Assessment
Overall: Low
grep -rn heapless --include="*.rs"returns nothingallocfeature is the only one used; heapless-cas was dead weightrand::Rng→rand::RngExt— 2 call sites, same behaviorRollback: Revert
default-features = falseon postcard and restoredeny.tomlignore entries.Test Plan
cargo tree -i atomic-polyfill --target all— package not found (eliminated)cargo tree -i heapless --target all— package not found (eliminated)cargo deny check advisories—advisories okcargo audit— 0 vulnerabilities across 312 cratescargo clippy --workspace -- -D warnings— zero warningscargo test --workspace— 1423 tests passcargo bench --no-run— all 5 benchmark suites compilejust ci-check— full local CI parity check passestest_process_data_validity_propertiesnow passes reliablyReview Checklist
unsafecodecargo clippy -- -D warningscleancargo fmt --all --checkcleanCargo.lockcommitted and consistent🤖 Generated with Claude Code