chore(deps): upgrade tabled to 0.22 and retire RUSTSEC-2026-0173

[chaliy]

What changed

One fewer advisory suppression, because the underlying dependency is actually gone.

tabled_derive 0.12 — pulled in by tabled 0.22 — no longer depends on the unmaintained proc-macro-error2. That was the exact removal condition recorded for the RUSTSEC-2026-0173 suppression, so the bench harness moves to tabled 0.22 and the suppression is deleted rather than left to rot:

• proc-macro-error2 and proc-macro-error-attr2 drop out of Cargo.lock entirely.
• The RUSTSEC-2026-0173 entry is removed from the [advisories] ignore list in deny.toml.
• The matching row is removed from the "Suppressed advisories" table in knowledge/security/threat-model.md, with a short note recording why it was legitimately retired — the section already warns that a suppression which merely stops matching is not evidence it can be dropped, so the distinction is worth writing down.
• cargo vet exemptions for tabled/tabled_derive are bumped to the new versions. This is required, not cosmetic: cargo vet --locked runs in CI and fails without it (proof below).

The two remaining suppressions stay, because neither removal condition is met:

Advisory	Crate	Why it stays
RUSTSEC-2023-0071	rsa	No patched version exists for any release; opt-in ssh feature only
RUSTSEC-2023-0089	atomic-polyfill	heapless is still pinned at 0.7 (via monty → postcard), which requires it

The atomic-polyfill row also gains that pin detail, so the next reader doesn't have to re-derive why it can't move yet.

Why

Routine scheduled maintenance. Auditing all four workspace lockfiles against OSV turned up three advisories; all three were already accepted in deny.toml, but one of them had a removal condition that upstream has since satisfied. Suppressions that outlive their justification are how an audit list stops being a signal, so it gets cleared the moment it can be.

Before / After

Advisory scan across every Cargo.lock in the repo (OSV, all four workspaces):

Before

Cargo.lock: 629 crates, 3 vulnerable
    ('atomic-polyfill', '1.0.3', ['RUSTSEC-2023-0089'])
    ('proc-macro-error2', '2.0.1', ['RUSTSEC-2026-0173'])
    ('rsa', '0.10.0-rc.18', ['RUSTSEC-2023-0071'])

After

Cargo.lock: 627 crates, 2 vulnerable
    ('atomic-polyfill', '1.0.3', ['RUSTSEC-2023-0089'])
    ('rsa', '0.10.0-rc.18', ['RUSTSEC-2023-0071'])
crates/bashkit/fuzz/Cargo.lock:      184 crates, 0 vulnerable
examples/hyperlight/Cargo.lock:      170 crates, 0 vulnerable
examples/hyperlight/host/Cargo.lock: 118 crates, 0 vulnerable

cargo vet --locked, with the exemption bump and without it:

$ cargo vet --locked
Vetting Succeeded (26 fully audited, 61 partially audited, 531 exempted)

$ git stash push supply-chain/config.toml && cargo vet --locked
Vetting Failed!
2 unvetted dependencies:
  tabled:0.22.0 missing ["safe-to-deploy"]
  tabled_derive:0.12.0 missing ["safe-to-deploy"]

Bench table rendering is unchanged across the tabled major bump (--category arithmetic, headers and Tabled derive attributes intact):

+------------+---------------+---------+-----------+--------+-------+-------+--------+-------+
| Category   | Benchmark     | Runner  | Mean (ms) | StdDev | Min   | Max   | Errors | Match |
+------------+---------------+---------+-----------+--------+-------+-------+--------+-------+
| arithmetic | arith_basic   | bashkit | 0.456     | ±0.001 | 0.455 | 0.457 | -      | ✓     |
+------------+---------------+---------+-----------+--------+-------+-------+--------+-------+
| arithmetic | arith_basic   | bash    | 2.110     | ±0.070 | 2.040 | 2.181 | -      | ✓     |
+------------+---------------+---------+-----------+--------+-------+-------+--------+-------+

The committed results/*.md reports are unaffected: generate_markdown_report builds those by hand with push_str and never touches tabled, so the /benches site aggregation contract is untouched.

Risk

• Low. tabled is a build/dev-time table formatter used only by bashkit-bench, a benchmarking binary. It is not part of any shipped library, binding, or ABI surface.
• What could break: terminal table formatting in the bench harness. Verified by running the harness and diffing the output shape — unchanged. cargo clippy -p bashkit-bench --all-targets -- -D warnings is clean, and all 7 bench unit tests pass.
• Licenses unchanged (tabled, tabled_derive, papergrid, testing_table are all MIT, already allow-listed), so cargo deny check licenses sources is unaffected.

Checklist

• Tests added or updated — no new tests; this is a dependency bump with no behavior change. Existing bashkit-bench tests (7) pass, and the advisory removal is itself verified by cargo vet --locked in CI.
• Backward compatibility considered — dev-dependency of a benchmark binary only; no public API, ABI, or serialized-format surface is touched.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	10c7628	Commit Preview URL Branch Preview URL	Sep 06 2026, 09:15 AM