fix(ci): repair Security Audit workflow and clear all RUSTSEC advisories - #7
Merged
Merged
Conversation
The Security Audit workflow has failed every scheduled run since 2026-07-19. rustsec/audit-check runs `cargo install cargo-audit` without --locked, so it resolves the newest deps; kstring 2.0.4 now requires rustc 1.96.0 while rust-toolchain.toml pins the job to 1.94. cargo-audit is a standalone tool, not part of this crate's build, so build it with the latest stable via RUSTUP_TOOLCHAIN, which overrides rust-toolchain.toml. Also adds the checks: write permission the action documents for creating its status check. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DRDwc4sxA6s6BBTLVEWYUd
cargo-audit could not run in CI since 2026-07-19, so five advisories
accumulated unnoticed. Three vulnerabilities, fixed by semver-compatible
lockfile updates:
RUSTSEC-2026-0204 crossbeam-epoch 0.9.18 -> 0.9.20
RUSTSEC-2026-0258 h2 0.4.13 -> 0.4.19
RUSTSEC-2026-0185 quinn-proto 0.11.14 -> 0.11.17
Two unsoundness warnings:
RUSTSEC-2026-0190 anyhow 1.0.102 -> 1.0.104
RUSTSEC-2026-0205 scc, reached only through the serial_test
dev-dependency; the fix landed in scc 3.8.4, so
serial_test moves 3 -> 4 to pick it up
`cargo audit` reports zero advisories. Full suite passes on the pinned
1.94 toolchain: 145 tests, fmt and clippy clean.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DRDwc4sxA6s6BBTLVEWYUd
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What broke
The weekly Security Audit workflow has failed every run since 2026-07-19 — 7 consecutive failures.
rustsec/audit-checkrunscargo install cargo-auditwithout--locked, so it resolves the newest compatible dependencies.kstring 2.0.4now requires rustc 1.96.0, butrust-toolchain.tomlpins the job to 1.94, so cargo-audit never compiled:The audit tool was never running, so real advisories piled up unseen.
Fix, part 1 — get the workflow running
cargo-audit is a standalone tool, not part of this crate's build, so it is built with the latest stable toolchain.
RUSTUP_TOOLCHAIN: stableoverridesrust-toolchain.tomlfor that job only; the crate's pinned channel is untouched everywhere else. Also adds thechecks: writepermission the action documents.Fix, part 2 — clear what the audit found
Once it ran, cargo-audit reported 3 vulnerabilities and 2 unsoundness warnings. All are transitive.
sccwas reached only through theserial_testdev-dependency, and its fix landed in scc 3.8.4 — a major bumpcargo updatecannot make. Movingserial_test3 → 4 dropssccfrom the tree entirely. This is the onlyCargo.tomlchange; it is dev-only and does not affect the shipped binary.Verification
cargo auditlocally: zero advisories, zero warnings (305 crates scanned)../scripts/preflight.sh: all checks pass on the pinned 1.94 toolchain — fmt, clippy-D warnings, 145 tests, release build.🤖 Generated with Claude Code
https://claude.ai/code/session_01DRDwc4sxA6s6BBTLVEWYUd