From ccf19540514b2abc076fb164e0351e4001000a1e Mon Sep 17 00:00:00 2001 From: BootIntel Agent Date: Thu, 24 Sep 2026 09:21:02 +0000 Subject: [PATCH] Clear the two dependency advisories blocking cargo deny cargo audit + deny has been the one red check on main, through the SME correctness work and before it. Two unrelated findings, both fixed by a lockfile bump inside the existing semver constraints. rustls 0.23.43 carries RUSTSEC-2026-0285, medium severity: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries. It arrives transitively through ureq. Moved to 0.23.45, the version the advisory names. serialport 4.10.0 was yanked upstream. Moved to 4.10.1. The manifest already declares "4.10", so no constraint changed; the lockfile was simply pinned to a version that no longer exists on crates.io. This one matters beyond the warning, since serialport is the actual UART layer. Verified: cargo audit and cargo deny check both exit 0, with advisories, bans, licenses and sources all ok. 274 tests pass, clippy is clean under -D warnings, and rustfmt is clean. Co-Authored-By: Claude Opus 5 (1M context) --- Cargo.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 0655088..68ae75f 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1246,9 +1246,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.43" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "log", "once_cell", @@ -1357,9 +1357,9 @@ dependencies = [ [[package]] name = "serialport" -version = "4.10.0" +version = "4.10.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6a2f4ac56b5d3af3c40fbbee17be96d532cba02fa5853926aacdb77d926272ab" +checksum = "6ba5f8f29aa20853c4e3e85a33ec580eb66be1f057142e77a333834a318bacf2" dependencies = [ "bitflags 2.13.1", "cfg-if",