fix(supply-chain): exempt PR 572 dependency batch

Merged
BN
11d ago
+180-0

Summary

This is the focused cargo-vet policy companion for PR #572 (breaking dependency batch). It adds only the exemptions required when #572's lockfile is merged onto current main (60e9742e, which already includes #585's 43 exemptions for #570).

  • supply-chain/config.toml only; no Cargo.lock, imports, source, or workflow changes.
  • 45 new safe-to-deploy entries, generated with cargo-vet 0.10.1 and checked against #572's actual lockfile.
  • Existing safe-to-run classifications are unchanged.
  • These are exemptions, not audits: the exemption entries unblock the policy gate while retaining the review backlog.

Evidence

The exact CI command is cargo vet --locked (workflow installs cargo-vet 0.10.1).

  • On #572's head alone (3c7539c5), the stale policy reports 88 unvetted dependencies; 43 of those are the versions already handled by merged #585.
  • On a merge simulation of #572 with current main's policy, the remaining failure is exactly 45 missing safe-to-deploy entries.
  • After this policy delta was applied to that merge simulation: cargo vet --locked succeeded — 17 fully audited, 2 partially audited, 472 exempted.
  • On this policy branch against current main's lockfile: cargo vet --locked succeeded — 18 fully audited, 5 partially audited, 465 exempted.

New shipped-path crates requiring human review

The following six crate names are genuinely new to current main's lockfile. They are marked as safe-to-deploy exemptions because cargo-vet classifies their normal dependency paths as shipped; they are not audits and should receive explicit human review:

  • phf_generator 0.11.3 via phf_macros 0.11.3 -> phf 0.11.3 -> cron 0.17.0 -> preloop-runner-server.
  • phf_macros 0.11.3 via phf 0.11.3 -> cron 0.17.0 -> preloop-runner-server.
  • rsqlite-vfs 0.1.1 via sqlite-wasm-rs 0.5.5 -> rusqlite 0.40.2 -> preloop-runner-server.
  • sqlite-wasm-rs 0.5.5 via rusqlite 0.40.2 -> preloop-runner-server.
  • toml_writer 1.1.3+spec-1.1.0 via toml 1.1.8+spec-1.1.0 -> preloop-runner-server.
  • typed-path 0.12.3 via zip 8.6.0 -> preloop-cli.

The other 39 entries refresh versions of crate names already present in current main's lockfile (including the axum, cap-std, nix, OpenTelemetry, rusqlite, Tokio/Tungstenite, TOML, tree-sitter, utoipa, and zip upgrades in #572).

Related PRs

  • #572 is the dependency PR this policy delta unblocks.
  • #585 is already merged and supplies the 43 exemptions for #570.
  • #583 remains an open, stale multi-batch proposal based on 7588d129; it includes #571 crypto-batch entries and superseded #570 entries, so this focused delta intentionally does not copy it.

Devin Review

Summary by cubic

Adds cargo-vet exemptions for the dependency upgrades in #572 so that its lockfile passes cargo vet --locked on current main.

  • Adds 45 new safe-to-deploy entries in supply-chain/config.toml; no audits are introduced and existing classifications are unchanged.
  • Six newly shipped crates (phf_generator, phf_macros, rsqlite-vfs, sqlite-wasm-rs, toml_writer, typed-path) are exempted and still need explicit human review before deployment.