#585 fix(supply-chain): refresh cargo-vet exemptions for the weekly dependency batch

Summary

main fails the Supply chain audit job: cargo vet --locked → Vetting Failed! 43 unvetted dependencies. This PR refreshes supply-chain/config.toml and supply-chain/imports.lock so the check passes on the current Cargo.lock. Policy-only: no Rust, lockfile, or workflow changes.

Overlap with #583. #583 (deps/vet-breaking-batch, open, targets main) also exempts these 43 versions, plus 54 more for the open #571 and #572 batches. It is additive (no removals). Both PRs edit supply-chain/config.toml, so they will conflict; only one should land first. This PR is the regenerate-and-prune fix for main as it stands today.

Root cause

The weekly batch 283e443 (#570) moved 37 exempted crates to new versions and pulled in 6 crates that were never exempted. supply-chain/config.toml pins exemptions to exact versions, and the batch did not touch supply-chain/. Checked against history: all 43 failing (crate, version) pairs first appear in 283e443's Cargo.lock, and the pre-batch exemptions (identical in the batch's config.toml) cover the old versions.

Fix

cargo vet regenerate exemptions --locked, then cargo vet prune --locked, using cargo-vet 0.10.1 (the version CI installs). No audits were added, and nothing was re-fetched from upstream. imports.lock changed only because cargo-vet drops entries for versions that left the graph.

New exemptions for crates never exempted before (needs review)

These are exemptions, not audits. A reviewer must accept each version or replace it with a real audit. Only zlib-rs is on a shipped code path.

Crate	Criteria	Path into the graph
zlib-rs 0.6.8	safe-to-deploy (shipped)	flate2 1.1.10 → preloop-cli (flate2 1.1.9 had no zlib-rs)
bit-set 0.11.1	safe-to-run (dev-only)	proptest 1.12.0
bit-vec 0.10.1	safe-to-run (dev-only)	proptest 1.12.0
borsh 1.8.1	safe-to-run (dev-only)	bit-vec 0.10.1 → proptest
borsh-derive 1.8.1	safe-to-run (dev-only)	borsh
core_detect 1.0.0	safe-to-run (dev-only)	proptest 1.12.0

bit-set and bit-vec were in the graph at 0.8.0, covered by Mozilla audits in imports.lock. Those audits are pruned now that the old versions have left the graph. borsh, borsh-derive, core_detect, and zlib-rs were not in Cargo.lock before the batch.

Exemption counts

	Entries
Before	475
Removed	49
Added	43
Unchanged	426
After	469

• Added (43): 35 replace an old exemption version. 2 add a version beside a still-graphed old one (base64 0.23.1 beside 0.22.1, foldhash 0.2.0 beside 0.1.5). 6 are the new crates above.
• Removed (49): 35 replaced old versions, plus 14 for versions absent from Cargo.lock. Four were already stale before the batch (aws-lc-rs 1.17.1, aws-lc-sys 0.42.0, rustls 0.23.41, rustls-webpki 0.103.13). Ten were dropped by the batch's lock update (windows-sys 0.60.2, windows-targets 0.53.5, eight windows_* 0.53.1).
• Kept on purpose: hashbrown 0.15.2, hashlink 0.7.0, libsqlite3-sys 0.25.2, and rusqlite 0.27.0 are absent from the lock, but they are base versions of Mozilla delta-audit chains (for example hashbrown 0.15.2 -> 0.15.5). Removing them makes cargo vet --locked fail with 5 unvetted dependencies (tested in a scratch copy).
• Criteria: no existing exemption changed criteria.

Version bumps of already-exempted crates (37)

• async-trait 0.1.89 → 0.1.92
• base64: 0.22.1 kept, 0.23.1 added
• bytes 1.12.0 → 1.12.1
• clap 4.6.1 → 4.6.7
• clap_builder 4.6.0 → 4.6.7
• clap_derive 4.6.1 → 4.6.7
• flate2 1.1.9 → 1.1.10
• foldhash: 0.1.5 kept, 0.2.0 added
• futures, futures-channel, futures-core, futures-executor, futures-io, futures-macro, futures-sink, futures-task, futures-util: 0.3.32 → 0.3.34 (9 crates)
• glob 0.3.3 → 0.3.4
• globset 0.4.18 → 0.4.20
• hyper 1.10.1 → 1.12.0
• hyper-util 0.1.20 → 0.1.21
• indexmap 2.14.0 → 2.14.2
• libc 0.2.186 → 0.2.190
• miniz_oxide 0.8.9 → 0.9.1
• proptest 1.11.0 → 1.12.0 (safe-to-run)
• rand_xorshift 0.4.0 → 0.5.0 (safe-to-run)
• regex 1.12.4 → 1.13.1
• regex-automata 0.4.14 → 0.4.18
• reqwest 0.13.4 → 0.13.5
• serde, serde_core, serde_derive: 1.0.228 → 1.0.229
• serde_json 1.0.150 → 1.0.154
• tokio 1.52.3 → 1.53.2
• tokio-util 0.7.18 → 0.7.20
• uuid 1.23.4 → 1.28.0
• want 0.3.1 → 0.3.2

Verification

Run from this branch with cargo-vet 0.10.1 and Rust 1.99, the versions pinned in .github/workflows/supply-chain.yml and rust-toolchain.toml. Run on macOS arm64; the CI runner is Linux.

• Reproduced on origin/main (7588d12, same Cargo.lock as 86f4977): exit 255, 43 unvetted dependencies, matching the CI log.
• CI's command on this branch:

  $ cargo vet --locked
  Vetting Succeeded (18 fully audited, 5 partially audited, 465 exempted)
  

  Exit 0. A second run leaves both files byte-identical.
• cargo audit (0.22.2): exit 0 with 3 allowed warnings, none caused by this diff: rustls-pemfile 2.2.0 (unmaintained), unsafe-libyaml 0.2.11 (unmaintained), chacha20 0.10.1 (yanked; already in the pre-batch lock).
• cargo deny check all (0.20.2): advisories ok, bans ok, licenses ok, sources ok.
• Not run: just test-ci. This PR changes no Rust, lockfile, or workflow, so the test gate does not exercise it.

Policy guard and CHANGELOG

The diff touches only supply-chain/*, so the guard in .github/workflows/supply-chain.yml accepts it. No CHANGELOG line: AGENTS.md says a PR that mixes supply-chain/ with non-policy files is rejected, and this fix is not user-facing.

CI

PR CI will not run: macstudio currently runs workflows only on main pushes. The first real run of this config will be the main push after merge. Not merged.

Checklist

• cargo vet --locked passes (evidence above)
• Protocol surface: NO
• Human review of the 6 new exemptions (zlib-rs first)
• just test-ci: not run (see Verification)

---

---

Summary by cubic

Refreshes the cargo-vet exemptions so the supply chain audit passes on the current Cargo.lock. The weekly dependency batch moved 37 exempted crates to new versions and pulled in 6 crates that were never exempted, so cargo vet --locked was failing with 43 unvetted dependencies. This regenerates and prunes the exemptions with cargo-vet 0.10.1 and adds no audits; the diff touches only supply-chain/*.

Needs review

• 6 first-time exemptions: zlib-rs 0.6.8 is safe-to-deploy and shipped via flate2, while bit-set, bit-vec, borsh, borsh-derive, and core_detect are safe-to-run and dev-only via proptest. These are exemptions, not audits; each needs reviewer sign-off.
• Exemptions for hashbrown, hashlink, libsqlite3-sys, and rusqlite are kept even though absent from the lock, because they anchor Mozilla delta-audit chains; pruning them fails vetting.
• Overlaps with #583, which also exempts these versions: both edit supply-chain/config.toml, so only one should land first.

Summary by CodeRabbit

• Chores
  • Updated third-party dependency review records for current versions, added records for several dependencies, and removed entries for older versions.
  • These maintenance updates do not change app functionality or introduce user-visible features.