cargo deny check advisories reports around twenty open RUSTSEC advisories in transitive dependencies. They came with the fork; none were introduced by work in this repository.
They cannot be cleared by updating everything at once: cargo update across the workspace produces a tree that does not compile, because starlark_map and hashbrown resolve to versions that disagree with each other. That is the same reason the desktop crate's lock file is seeded from the main one rather than resolved independently.
What is needed is crate-by-crate: bump what can move, work out what pins the rest, and record an explicit ignore with a reason for anything that genuinely cannot move.
Until then the advisory check runs on every commit and weekly on a schedule, and reports without gating — see .github/workflows/cargo-deny.yml.
cargo deny check advisoriesreports around twenty open RUSTSEC advisories in transitive dependencies. They came with the fork; none were introduced by work in this repository.They cannot be cleared by updating everything at once:
cargo updateacross the workspace produces a tree that does not compile, becausestarlark_mapandhashbrownresolve to versions that disagree with each other. That is the same reason the desktop crate's lock file is seeded from the main one rather than resolved independently.What is needed is crate-by-crate: bump what can move, work out what pins the rest, and record an explicit ignore with a reason for anything that genuinely cannot move.
Until then the advisory check runs on every commit and weekly on a schedule, and reports without gating — see
.github/workflows/cargo-deny.yml.