Patch dependency advisories and modernize CI coverage - #18
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The remaining lockfile dependencies include one vulnerability advisory and one unsoundness advisory, while CI previously validated only Linux with all/no features.
Patch
crossbeam-epoch0.9.18 → 0.9.20 andanyhow1.0.100 → 1.0.103, including the direct anyhow version floor. Keep the complete removal of memmap2 already merged in #14. Add warnings-denied dependency audits on PRs, main, and weekly schedules, plus Dependabot updates.Expand CI to Linux/macOS/Windows, every individual language feature, minimal builds, and Rust 1.88. Pin current actions to verified commit SHAs, align pre-commit checks, require locked release builds, remove
cargo publish --allow-dirty, and restrict write permission to the publication job.The combined Windows CI run exposed callers holding temporary output files open while the scanner atomically replaces them. Close those handles in integration tests and benchmark callers using
into_temp_path(), retaining automatic cleanup. Add an existing-output replacement regression test and document the Windows requirement.The review report records reproduced defects, advisory evidence, and remaining issues requiring semantic design or library documentation. Exploitability of the advisory-affected functions through this scanner has not been established.
Validation after incorporating main: formatting, all-target Clippy with warnings denied under all and minimal features, complete all-feature/minimal test suites, actionlint, and
cargo audit --deny warningspass locally. The scanner implementation and lockfile match the previously validated combined branch, which also passed every individual language suite, Rust 1.88 checks, andcargo package --locked. GitHub CI checks the updated PR across platforms and feature combinations. Release publication was not executed.Advisories: RUSTSEC-2026-0204, RUSTSEC-2026-0190. The memmap2 advisory RUSTSEC-2026-0186 is addressed by its removal.
Part 5 of the review series. #14–#17 are merged into main, which is included in this branch. Patterns and fixtures remain unchanged.