You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Follow-up to #108. Once the deps lane could actually see Cargo.lock, it reported 11 vulnerabilities across 9 packages (446 packages scanned). #111 cleared everything reachable cheaply; these are what is left, and they need three different kinds of work.
The real work here. 209 call sites across five workspace members — crates/hooksmith-app, crates/xtask, crates/core, crates/hooksmith-validate, crates/scripts — declared once as git2 = "0.18" in the workspace table.
Worth checking against #83 before starting: crates/components/git-proxy is quarantined with "19 compile errors (git2 Send/Sync, async-trait mismatches)". If those errors are against 0.18's API, a 0.21 migration either fixes or reshapes them, so the two items likely want doing together rather than in sequence.
2. lru 0.12.5 → 0.16.3 — 1 advisory
RUSTSEC-2026-0002 / GHSA-rhfx-m35p-ff5j (CVSS 2.7). Transitive, and not directly bumpable: cargo update -p lru locks 0 packages because its only parent is ratatui, whose range does not admit 0.16.3. Needs a ratatui bump first, which is its own compatibility question. No workspace member imports lru directly (0 code references).
3. Seven advisories with no fixed version
backoff 0.4.0, derivative 2.2.0, instant 0.1.13, number_prefix 0.4.0, paste 1.0.15, rustls-pemfile 1.0.4 and 2.2.0 — all -- in the FIXED VERSION column. These are unmaintained-crate advisories, which is exactly the case deps.yml documents the escape hatch for:
The reviewable escape hatch for an accepted or unfixable finding is an osv-scanner.toml[[IgnoredVulns]] entry next to the lockfile, with a written reason.
Both #110 and #111 deliberately declined to write those entries, for the same reason: an ignore entry is an accepted-risk decision belonging to a maintainer, not a rider on a PR about a scanner bug. Writing them is a real task with a real judgement in it — hence this issue rather than a silent config change.
Note the asymmetry that matters: ignoring these 7 is defensible because no fix exists. Ignoring the 4 in §1–2 would not be — they are fixable, and suppressing them recreates precisely the green-over-real-findings state #108 existed to end.
Suggested order
§3 — cheapest, and it drops the lane from 11 findings to 4, which makes the remaining two legible instead of lost in a wall.
Before #108, this lane was green while scanning nothing (0 Extract calls) and had been for months. #107 and #111 cleared 42 advisories between them. The lane is red now because it is finally accurate, and it should stay red until these are genuinely resolved rather than be quieted to look finished.
kind: task
effort: 5
value: 60
Follow-up to #108. Once the deps lane could actually see
Cargo.lock, it reported 11 vulnerabilities across 9 packages (446 packages scanned). #111 cleared everything reachable cheaply; these are what is left, and they need three different kinds of work.1.
git20.18.3 → 0.21.0 — 3 advisoriesThe real work here. 209 call sites across five workspace members —
crates/hooksmith-app,crates/xtask,crates/core,crates/hooksmith-validate,crates/scripts— declared once asgit2 = "0.18"in the workspace table.Worth checking against #83 before starting:
crates/components/git-proxyis quarantined with "19 compile errors (git2 Send/Sync, async-trait mismatches)". If those errors are against 0.18's API, a 0.21 migration either fixes or reshapes them, so the two items likely want doing together rather than in sequence.2.
lru0.12.5 → 0.16.3 — 1 advisoryRUSTSEC-2026-0002 / GHSA-rhfx-m35p-ff5j (CVSS 2.7). Transitive, and not directly bumpable:
cargo update -p lrulocks 0 packages because its only parent isratatui, whose range does not admit 0.16.3. Needs aratatuibump first, which is its own compatibility question. No workspace member importslrudirectly (0 code references).3. Seven advisories with no fixed version
backoff0.4.0,derivative2.2.0,instant0.1.13,number_prefix0.4.0,paste1.0.15,rustls-pemfile1.0.4 and 2.2.0 — all--in the FIXED VERSION column. These are unmaintained-crate advisories, which is exactly the casedeps.ymldocuments the escape hatch for:Both #110 and #111 deliberately declined to write those entries, for the same reason: an ignore entry is an accepted-risk decision belonging to a maintainer, not a rider on a PR about a scanner bug. Writing them is a real task with a real judgement in it — hence this issue rather than a silent config change.
Note the asymmetry that matters: ignoring these 7 is defensible because no fix exists. Ignoring the 4 in §1–2 would not be — they are fixable, and suppressing them recreates precisely the green-over-real-findings state #108 existed to end.
Suggested order
ratatuibump, probably mechanical.Context worth not relosing
Before #108, this lane was green while scanning nothing (
0 Extract calls) and had been for months. #107 and #111 cleared 42 advisories between them. The lane is red now because it is finally accurate, and it should stay red until these are genuinely resolved rather than be quieted to look finished.