tmk241/hemx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(deps): replace retired transitive crates

Browse Source
This commit is contained in:
slhx agent
2026-07-14 09:44:19 +02:00
parent 48d6ea31be
commit a04773d016
15 changed files with 154 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files
PLAN.md
+2 -2
View File
@@ -71,10 +71,10 @@ encryption, retention, backup, and deployment policy remain host concerns.
## Slice 7 — v1 compatibility and closure
- [ ] **User value:** maintainers and adopters receive a reproducible, migration-aware v1 with no known material contradiction and no hidden publication side effect.
- **State:** Blocked only on externally unavailable audit tools — all reachable local release gates pass, but `cargo-audit` and `cargo-deny` are not installed and dependency installation is not authorized.
- **State:** In progress — audit tools are installed and the pinned dependency update removes the `fxhash`, `paste`, `spin`, and vulnerable `quinn-proto` findings without raising the Rust 1.80 baseline; no repository license policy exists yet for an approved license audit.
- **Build:** freeze the supported Rust/browser/WASM/integration matrix; reconcile public/generated/Surface/symbol/wire/runtime/persisted-schema compatibility; add migration fixtures; make canonical examples compatibility tests; update the progressive tutorial path; run all local release gates and disposition every P0/P1, advisory, unsafe-code, license, performance, accessibility, and documentation finding.
- **Refusals:** no publish, deploy, upload, store submission, speculative feature, or weakening a gate to make it pass.
- **Requirements:** `v1_release/001-010`, `versioning/*`, `test/*`, `diag/*`, `performance/*`, `security/008`, and all requirements changed by the preceding slices.
- **Proof:** clean-tree formatting, workspace tests, strict all-target Clippy, compile-fail, browser/WASM/offline/multiplayer scenarios, benchmark budgets, approved pinned lockfile audit, requirements proof audit, docs/examples checks, and independent contradiction review all pass with no unresolved P0/P1.
`cargo test -p hemx-core --test effect_batch compatibility_fixture_accepts_only_the_declared_v1_wire_version -- --exact`, `cargo test -p hemx-wasm --test browser flat_patch_persists_offline_then_uploads_with_same_operation_identity -- --exact`, and the four canonical example package tests prove compatibility. The release audit fixed genuine local failures: the app-facing durable-sync primitive accepts ordinary `IntoEffect`, the canonical example contract recognizes the isolated legacy fixture, the 413-requirement corpus is migrated losslessly to installed redgate format, and `html-examples-smoke` launches its child from the workspace rather than the caller directory. `cargo run -p hemx-xtask -- test`, `cargo run -p hemx-xtask -- bench`, `cargo run -p hemx-xtask -- html-examples-smoke`, strict all-target Clippy, warning-denied workspace docs, and workspace doctests pass. README/readiness contradiction review now matches the proven cursor. `cargo audit --version` and `cargo deny --version` both fail with Cargo `no such command`; dependency installation and the approved pinned dependency/license audit remain externally blocked. Execution cursor: obtain explicit installation authority or a supplied environment containing `cargo-audit` and `cargo-deny`, run the pinned lockfile audits, then close Slice 7 if clean.
`cargo test -p hemx-core --test effect_batch compatibility_fixture_accepts_only_the_declared_v1_wire_version -- --exact`, `cargo test -p hemx-wasm --test browser flat_patch_persists_offline_then_uploads_with_same_operation_identity -- --exact`, and the four canonical example package tests prove compatibility. The release audit fixed genuine local failures: the app-facing durable-sync primitive accepts ordinary `IntoEffect`, the canonical example contract recognizes the isolated legacy fixture, the 413-requirement corpus is migrated losslessly to installed redgate format, and `html-examples-smoke` launches its child from the workspace rather than the caller directory. `cargo run -p hemx-xtask -- test`, `cargo run -p hemx-xtask -- bench`, `cargo run -p hemx-xtask -- html-examples-smoke`, strict all-target Clippy, warning-denied workspace docs, and workspace doctests pass. README/readiness contradiction review matches the proven cursor. After installing `cargo-audit 0.22.1` and `cargo-deny 0.19.0`, upgrading `scraper` removes yanked `fxhash`, a tiny local package-identity bridge moves legacy `paste` consumers to maintained `pastey`, another moves Multer's `spin 0.9` requirement to maintained `spin 0.12`, and `quinn-proto 0.11.15` resolves its advisory. Both bridges only re-export the maintained crate, forbid unsafe code, and preserve the Rust 1.80 baseline. `cargo audit -D warnings --file Cargo.lock` and `cargo deny check advisories sources` pass. Execution cursor: decide and record the repository's license allowlist, run strict `cargo-deny` license checks, then close Slice 7 if clean.