Skip to content

Remaining advisories after the scanner unblind: git2 migration, lru via ratatui, and 7 unmaintained crates #112

Description

@bdelanghe

kind: task
effort: 5
value: 60

Follow-up to #108. Once the deps lane could actually see Cargo.lock, it reported 11 vulnerabilities across 9 packages (446 packages scanned). #111 cleared everything reachable cheaply; these are what is left, and they need three different kinds of work.

1. git2 0.18.3 → 0.21.0 — 3 advisories

advisory fixed in
RUSTSEC-2026-0008 / GHSA-j39j-6gw9-jw6h (CVSS 2.7) 0.20.4
RUSTSEC-2026-0183 0.21.0
RUSTSEC-2026-0184 0.21.0

The real work here. 209 call sites across five workspace memberscrates/hooksmith-app, crates/xtask, crates/core, crates/hooksmith-validate, crates/scripts — declared once as git2 = "0.18" in the workspace table.

Worth checking against #83 before starting: crates/components/git-proxy is quarantined with "19 compile errors (git2 Send/Sync, async-trait mismatches)". If those errors are against 0.18's API, a 0.21 migration either fixes or reshapes them, so the two items likely want doing together rather than in sequence.

2. lru 0.12.5 → 0.16.3 — 1 advisory

RUSTSEC-2026-0002 / GHSA-rhfx-m35p-ff5j (CVSS 2.7). Transitive, and not directly bumpable: cargo update -p lru locks 0 packages because its only parent is ratatui, whose range does not admit 0.16.3. Needs a ratatui bump first, which is its own compatibility question. No workspace member imports lru directly (0 code references).

3. Seven advisories with no fixed version

backoff 0.4.0, derivative 2.2.0, instant 0.1.13, number_prefix 0.4.0, paste 1.0.15, rustls-pemfile 1.0.4 and 2.2.0 — all -- in the FIXED VERSION column. These are unmaintained-crate advisories, which is exactly the case deps.yml documents the escape hatch for:

The reviewable escape hatch for an accepted or unfixable finding is an osv-scanner.toml [[IgnoredVulns]] entry next to the lockfile, with a written reason.

Both #110 and #111 deliberately declined to write those entries, for the same reason: an ignore entry is an accepted-risk decision belonging to a maintainer, not a rider on a PR about a scanner bug. Writing them is a real task with a real judgement in it — hence this issue rather than a silent config change.

Note the asymmetry that matters: ignoring these 7 is defensible because no fix exists. Ignoring the 4 in §1–2 would not be — they are fixable, and suppressing them recreates precisely the green-over-real-findings state #108 existed to end.

Suggested order

  1. §3 — cheapest, and it drops the lane from 11 findings to 4, which makes the remaining two legible instead of lost in a wall.
  2. §2 — one ratatui bump, probably mechanical.
  3. §1 — the migration, ideally folded into Clean-foundation debts: restore quarantined crates + re-enable strict CI #83.

Context worth not relosing

Before #108, this lane was green while scanning nothing (0 Extract calls) and had been for months. #107 and #111 cleared 42 advisories between them. The lane is red now because it is finally accurate, and it should stay red until these are genuinely resolved rather than be quieted to look finished.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    Status
    Todo

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions