chore(deps): Harden supply-chain checks via cargo-deny and dependabot grouping#135
Merged
Conversation
Bundle related crate updates (serde, tracing, resvg) and frontend tooling (oxc) into single PRs to cut review noise from weekly dependabot runs.
Expand deny.toml beyond licenses so RUSTSEC vulnerabilities, yanked crates, and unknown registries fail CI. Bump rustls-webpki via `cargo update` to clear four advisories; document the remaining unfixable ones (rsa Marvin Attack, rustls-pemfile unmaintained, tokio-tar PAX) in the ignore list with rationale. Wildcards stay at warn until workspace crates adopt `publish = false`. Rename the `license-check` make target to `deny-check` and run `cargo deny check all` from CI and lefthook to cover every category in one pass.
GoReleaser-published checksums.txt may list filenames with a leading '*' (sha256sum binary mode) or './' (path-prefixed) depending on how the file was generated. The previous '$2 == a' comparison only matched bare filenames and would silently produce zero hits for those formats, falling through to the "Archive not found in checksums.txt" error. Strip both prefixes from the second field before comparing.
Code Metrics Report
Details | | main (e4c1b93) | #135 (3a0a742) | +/- |
|---------------------|----------------|----------------|------|
| Coverage | 94.9% | 94.9% | 0.0% |
| Files | 81 | 81 | 0 |
| Lines | 39248 | 39248 | 0 |
| Covered | 37253 | 37253 | 0 |
- | Test Execution Time | 1m33s | 1m55s | +22s |Reported by octocov |
Schema reviewTip ✅ No risk findings — schema changes look safe to merge. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
install.shaccept the*(sha256sum binary mode) and./(path-prefixed) filename styles that GoReleaser may emit, so checksum verification no longer silently misses on release artifacts.Changes
deny.tomlwith[advisories],[bans],[sources]. Yanked crates are denied; three unfixable advisories (RUSTSEC-2023-0071rsa Marvin Attack,RUSTSEC-2025-0134rustls-pemfile unmaintained,RUSTSEC-2025-0111tokio-tar) are ignored with documented rationale and pointers for follow-up.rustls-webpkito 0.103.13 viacargo update -p rustls-webpki, clearing four active RUSTSEC entries; wildcards stay atwarnuntil workspace crates adoptpublish = false.license-checkmake target todeny-checkand runcargo deny check allfrom CI and lefthook so every category (advisories / bans / licenses / sources) is gated in one pass.*and./from the second field ofchecksums.txtlines before comparing against the archive name, so binary-mode and path-prefixed entries verify correctly instead of dropping through to the "Archive not found" error.