fix(security): update ruint past RUSTSEC-2026-0220 - #522
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…onfig pins (#562) * fix(security): bump ruint past RUSTSEC-2026-0220 in prediction-markets lockfile PR #522 updated only the main workspace lock; ploy-ci's Dependency audit scans rust_hft/prediction-markets/Cargo.lock and now fails repo-wide on lanes that trigger it. Closes #561 * test(ploy): update tape config pins for Binance kinds and tick-level sampling The scope-gated CI let #550/#548 merge without running workspace_runtime_retirement; its pinned include_kinds and quote_sample_ms went stale. Refs #540 Refs #539 * fix(research): refresh checked-in Linux policy graph for ruint bump The build.rs graph validator requires input:Cargo.lock to hash the workspace lockfile exactly; the ruint bump changed it. ruint itself is not in the Linux policy package set, so only the input line and the canonical fingerprint need refreshing. Refs #561 * test(research): re-pin mission templates to refreshed policy snapshot id The policy snapshot id is derived from the dependency fingerprint; the ruint lockfile refresh changed it, so the checked-in BTC/SOL mission templates must be re-pinned. Refs #561 --------- Co-authored-by: Sonic Shih <sonic.shih@mandonothing.com>
1 participant
Change contract
Resolve
ruintat patched version 1.20.0 so required Cargo audit no longerreports
RUSTSEC-2026-0220, without changing runtime code or dependencyfeatures.
Issue relationship
Closes #521
Out of scope
Polymarket Gate/rollback behavior, CI restructuring, other dependency upgrades,
production mutation, research, snapshot/#235, evaluator/MCTS, and artifacts.
Dependency or merge order
Merge this PR before rebasing PR #520 onto the resulting exact
main.Focused validation
cargo audit --json: RED onRUSTSEC-2026-0220/ruint 1.19.0.cargo audit --json: PASS with zero vulnerabilities.cargo metadata --locked --format-version 1 --no-deps: PASS.cargo test --locked -p hft-data-adapter-polymarket -p hft-execution-adapter-polymarket: 61 passed, 0 failed, 1 ignored.git diff --check: PASS.Rollout/rollback impact
No production rollout. Roll back by reverting this two-line lockfile resolution
change; doing so reintroduces the advisory and required audit failure.