6e1041a1f6
All checks were successful
build-and-release / build (companies) (push) Successful in 5s
build-and-release / build (cron) (push) Successful in 5s
build-and-release / build (developers) (push) Successful in 6s
build-and-release / build (employees) (push) Successful in 6s
build-and-release / build (fitness-trainers) (push) Successful in 6s
build-and-release / build (gateway) (push) Successful in 7s
build-and-release / build (graphic-designers) (push) Successful in 8s
build-and-release / build (job-seekers) (push) Successful in 10s
build-and-release / build (customers) (push) Successful in 20s
build-and-release / build (catering-services) (push) Successful in 21s
build-and-release / build (makeup-artists) (push) Successful in 7s
build-and-release / build (jobs) (push) Successful in 6s
build-and-release / build (payments) (push) Successful in 7s
build-and-release / build (photographers) (push) Successful in 7s
build-and-release / build (ugc-content-creators) (push) Successful in 7s
build-and-release / build (tutors) (push) Successful in 8s
build-and-release / build (social-media-managers) (push) Successful in 11s
build-and-release / build (users) (push) Successful in 5s
build-and-release / build (video-editors) (push) Successful in 6s
cargo audit flagged RUSTSEC-2026-0235 (rkyv, out-of-bounds read) via rust_decimal's optional rkyv feature, which apps/payments never enables (features = ["db-tokio-postgres"] only) - confirmed absent from the actual feature-resolved graph via cargo tree, and cargo-deny (which is feature-aware) already doesn't flag it. Added to both deny.toml and .cargo/audit.toml so cargo audit also exits 0. Also re-documented the 4 pre-existing crate-name-collision ignores in .cargo/audit.toml (RUSTSEC-2020-0128/2021-0006/2023-0040/2023-0059 - our own workspace crates crates/cache and apps/users happen to share name+version with unrelated abandoned crates.io packages) with fuller explanation, and mirrored them into deny.toml for a single source of truth even though cargo-deny's real graph resolution never matched them in the first place. Verified: cargo audit and cargo deny check advisories bans both now exit 0 against the live server runbook's requirement. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| audit.toml | ||
| config.toml | ||