From fe38b07a1c8a9d8bc562e94555e271c44206b6dd Mon Sep 17 00:00:00 2001
From: Lev Velykoivanenko <velykoivanenko.lev@gmail.com>
Date: Sat, 19 Sep 2026 16:52:07 +0200
Subject: [PATCH 1/2] fix(deps): bump rustls for RUSTSEC-2026-0285

rustls 0.23.40 accepts TLS 1.3 handshake messages across encryption
level boundaries. 0.23.45 fixes it; rustls-webpki moves with it.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
---
 Cargo.lock | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 66fc9a66..b3604957 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1194,9 +1194,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.40"
+version = "0.23.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
 dependencies = [
  "log",
  "once_cell",
@@ -1218,9 +1218,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
  "ring",
  "rustls-pki-types",

From 82e0af7e0de04f9a257b440b596a7de610a98944 Mon Sep 17 00:00:00 2001
From: Lev Velykoivanenko <velykoivanenko.lev@gmail.com>
Date: Sat, 19 Sep 2026 16:52:07 +0200
Subject: [PATCH 2/2] ci: add cargo audit job and task

Nothing checked Cargo.lock against the RustSec advisory database, so
a vulnerable dependency could sit in the lockfile unnoticed. CI now
runs cargo audit on every push and PR, and `devrun task audit` runs
the same check locally.

Closes #105

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 9 +++++++++
 devkit.toml              | 5 +++++
 2 files changed, 14 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c005767b..8f7f2427 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,6 +27,15 @@ jobs:
           components: rustfmt
       - run: cargo +nightly fmt --all -- --check
 
+  audit:
+    name: cargo audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v7
+      - uses: taiki-e/install-action@cargo-audit
+      - run: cargo audit
+
   clippy:
     name: clippy (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
diff --git a/devkit.toml b/devkit.toml
index f7a5c84f..bfdad284 100644
--- a/devkit.toml
+++ b/devkit.toml
@@ -29,6 +29,11 @@ programs = ["git"]
 args = ["worktree", "remove"]
 reason = "Use devkit's issue binary to remove worktrees: issue end [branch-name]"
 
+[tasks.audit]
+description = "Check Cargo.lock against the RustSec advisory database"
+run = ["cargo", "audit"]
+guard = true
+
 [tasks.build]
 description = "Build the workspace"
 run = ["cargo", "build", "--workspace", "--locked"]