cargo audit flagged RUSTSEC-2026-0235 (rkyv, out-of-bounds read) via
rust_decimal's optional rkyv feature, which apps/payments never enables
(features = ["db-tokio-postgres"] only) - confirmed absent from the
actual feature-resolved graph via cargo tree, and cargo-deny (which is
feature-aware) already doesn't flag it. Added to both deny.toml and
.cargo/audit.toml so cargo audit also exits 0.
Also re-documented the 4 pre-existing crate-name-collision ignores in
.cargo/audit.toml (RUSTSEC-2020-0128/2021-0006/2023-0040/2023-0059 -
our own workspace crates crates/cache and apps/users happen to share
name+version with unrelated abandoned crates.io packages) with fuller
explanation, and mirrored them into deny.toml for a single source of
truth even though cargo-deny's real graph resolution never matched
them in the first place.
Verified: cargo audit and cargo deny check advisories bans both now
exit 0 against the live server runbook's requirement.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Update jsonwebtoken from 9.3 to 10.3 in crates/auth/Cargo.toml and crates/contracts/Cargo.toml
- Create .cargo/audit.toml to ignore false positives for local workspace crates 'cache' and 'users'
- Fix pre-existing compile errors in crates/cache/src/ollama.rs (missing reqwest dep, broken format! string literals)
- Add reqwest workspace dependency to crates/cache/Cargo.toml
