Dependency Audit — March 2026

On this page

Status

COMPLETE

Summary

All 30 workspace dependencies were audited on March 5, 2026. Of 30 dependencies, 23 were already at their latest version. Four were upgraded, one was removed (deprecated), and two were deferred with documented rationale.

Audit Results

Already Current (23 crates)

axum 0.8, tower 0.5, tower-http 0.6, hyper 1, sqlx 0.8, clap 4, clap_complete 4, rpassword 7, dirs 6, mime_guess 2, serde 1, serde_json 1, utoipa 5, utoipa-swagger-ui 9, tokio 1, tracing 0.1, tracing-subscriber 0.3, uuid 1, chrono 0.4, object_store 0.13, bytes 1, futures 0.3, thiserror 2, anyhow 1, tempfile 3, config 0.15, dotenvy 0.15

Upgraded (4 crates)

Crate From To Risk Changes Required

tabled

0.17

0.20

Low

Zero code changes

jsonwebtoken

9

10

Low

Added rust_crypto feature in Cargo.toml

zen-engine

0.25

0.54

Medium

~15 lines across engine.rs + 2 test files

lapin

2

4

High

~25 lines across publisher.rs, subscriber.rs, events.rs

Removed (1 crate)

  • serde_yaml 0.9 — deprecated, RUSTSEC advisory on fork. Removed YAML CLI output format.

Deferred (2 crates)

  • toml 0.8 — 1.0 too new (released Feb 2026). Revisit Q3 2026.

  • reqwest 0.12 — 0.13 requires NASM for aws-lc-rs on Windows. Revisit when resolved upstream.

Execution Order

Steps were executed in risk order (lowest first), each as a separate commit for bisection:

  1. tabled 0.17 → 0.20

  2. Drop serde_yaml, remove -f yaml CLI format

  3. Pin toml 0.8 with comment

  4. jsonwebtoken 9 → 10 (rust_crypto backend)

  5. Pin reqwest 0.12 with comment

  6. zen-engine 0.25 → 0.54

  7. lapin 2 → 4

  8. Documentation and cleanup

Decision Records

See ADR-007: Dependency Audit Decisions for detailed rationale on each decision.

Verification

  • cargo fmt --check --all — clean

  • cargo clippy --workspace --locked — zero warnings (in upgraded crates)

  • cargo test --workspace — all unit + ruleset eval + CLI tests pass

  • Integration and E2E tests validated via CI pipeline

Edit this page · latest