cargo audit flagged RUSTSEC-2026-0235 (rkyv, out-of-bounds read) via
rust_decimal's optional rkyv feature, which apps/payments never enables
(features = ["db-tokio-postgres"] only) - confirmed absent from the
actual feature-resolved graph via cargo tree, and cargo-deny (which is
feature-aware) already doesn't flag it. Added to both deny.toml and
.cargo/audit.toml so cargo audit also exits 0.
Also re-documented the 4 pre-existing crate-name-collision ignores in
.cargo/audit.toml (RUSTSEC-2020-0128/2021-0006/2023-0040/2023-0059 -
our own workspace crates crates/cache and apps/users happen to share
name+version with unrelated abandoned crates.io packages) with fuller
explanation, and mirrored them into deny.toml for a single source of
truth even though cargo-deny's real graph resolution never matched
them in the first place.
Verified: cargo audit and cargo deny check advisories bans both now
exit 0 against the live server runbook's requirement.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Upgrade printpdf 0.7 → 0.12.5 in job_seekers (fixes lopdf HIGH CVE RUSTSEC-2023-0068)
Rewrote build_resume_pdf() for the new Op-based API; same PDF output
- Add wallet/me/holds and wallet/me/holds/{id}/release routes to profession_shared
Backed by wallet::hold::list_for_user and wallet::hold::release
Applies to all 9 profession services via the shared router
- Add deny.toml for cargo-deny (advisory + ban policy enforcement)
RSA timing CVE and bincode unmaintained acknowledged with documented reasons
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
