[dannxbt]

Adds package audit checks that run on every PR, following the setup in MeteoraAg/zap-program#58 and the SDK repos.

New CI jobs

• clippy: cargo clippy --locked --all-targets -- -D warnings in ci.yml, on the toolchain from rust-toolchain.toml (1.93.0), the same one cargo_test uses.
• cargo_deny: cargo deny check for advisories, licenses, banned crates and sources, configured in deny.toml. Ignored advisories are listed there, each with a reason.
• osv_scanner: OSV-Scanner on bun.lock. It can't tell dev dependencies apart in bun.lock, so they're scanned too. Ignored advisories are listed in osv-scanner.toml, each with a reason.

cargo_deny and osv_scanner are in a new dependency-audit.yml, which runs on every PR, whatever the base branch or the files changed: new advisories are published against dependencies that are already in the lockfile. clippy has the same programs/dynamic-fee-sharing filter as cargo_test.

Other changes

• Clippy fixes in the program code (programs/dynamic-fee-sharing/src). None of them changes behaviour:

  • Lints in code generated by anchor-lang 1.0.2. #[event_cpi] adds AccountInfo fields, which the Accounts derive then flags as deprecated in the impl it generates next to the struct, so the five pub mod ix_*; declarations get #[allow(deprecated)]. #[program] type checks the instruction arguments with let _: T = panic!() at the crate root, so clippy::diverging_sub_expression is allowed in lib.rs. Anchor 1.1.2 and later generate neither.
  • #[allow(clippy::too_many_arguments)] on create_fee_vault and FeeVault::initialize.
  • Mechanical rewrites: ok_or instead of ok_or_else with a plain value, range contains, *x instead of .clone() on a Copy type, dropped .as_ref() / Box / field-init shorthand that did nothing, assert! instead of assert_eq!(…, true) in the SafeMath tests, users.iter().enumerate() instead of an index loop, and a removed use std::u32.

  These rewrites change the program binary. The TypeScript tests (16, on litesvm) pass on it.

• deny.toml, based on zap-program's. Unmaintained crates count as errors, so the ones with no replacement upstream are ignored individually.

• publish = false on dynamic-fee-sharing, damm-v2 and dynamic-bonding-curve, so cargo-deny skips the license check for them. They have no license field and aren't on crates.io.

• bunfig.toml with minimumReleaseAge = 604800, so bun only resolves versions published at least a week ago.

• bun update of ws (7.5.10 to 7.5.13 and 8.20.0 to 8.22.0), uuid 11.1.0 to 11.1.1 (the copy under rpc-websockets) and brace-expansion 1.1.14 to 1.1.21, within the existing ranges. Only those four bun.lock entries change. All were released more than a week ago.

On-chain crate bump, this changes the program binary:

• ruint 1.14.0 to 1.17.2 (released 2025-12-28), fixing RUSTSEC-2025-0137. Cargo.lock also gains entries for ruint's optional dependencies (ark-ff 0.5, educe, enum-ordinalize, itertools 0.13, syn 3), which aren't compiled.

Ignored advisories
deny.toml ignores two, both reaching the program:

• bincode (RUSTSEC-2025-0141, unmaintained, no fix), via anchor-lang, same as zap-program.
• ruint RUSTSEC-2026-0220 (wrong overflow flag in overflowing_shl/shr). The fix is in 1.20.0, which needs rustc 1.90. anchor build 1.0.2 passes --tools-version v1.52 by default, and those platform-tools ship rustc 1.89: with ruint 1.21.1 the build stops with "ruint@1.21.1 requires rustc 1.90". The program's only ruint shift is the overflowing_shr in mul_shr, which discards the flag, and the shifted value was always correct. SafeMath implements checked_shl/checked_shr for U256/U512, but nothing in the program calls them.

osv-scanner.toml ignores 28, none of which has a fix within the versions upstream depends on:

• Through @anchor-lang/core > @solana/web3.js, the same as the SDK repos: toml 3 (6 advisories; @anchor-lang/core only parses Anchor.toml in workspace, which the tests don't use), and stream-json 1 (3) and uuid 8 (1) via jayson, which web3.js only loads as jayson/lib/client/browser.
• bigint-buffer (no patched version), via @solana/spl-token.
• Dev only, exact versions pinned by mocha 9 (fixes are in mocha 10+, outside ^9.0.3): diff 5.0.0 (mocha only calls createPatch), js-yaml 4.1.0 (5, only for .mocharc.yml, which the repo doesn't have), minimatch 4.2.1 (3, only for --ignore patterns, none passed), nanoid 3.3.1 (4, mocha calls nanoid() with the default size) and serialize-javascript 6.0.0 (4, only used in --parallel mode).

Notes

• The Rust checks and integration tests in ci.yml only run when programs/dynamic-fee-sharing changes. This PR touches that directory, so they run here.
• actionlint still reports the two pre-existing Swatinem/rust-cache@v1 findings in ci.yml. Those jobs were not changed.

Checked locally

• cargo-deny 0.20.2 (the version in cargo-deny-action v2.1.1), run as the action does (--all-features check): passes. Each ignored advisory is still reported without its ignore.
• osv-scanner scan source -L bun.lock (2.7.0) from the repo root: no issues. The ignore list matches exactly the 28 advisories reported without it.
• Rust 1.93.0: cargo clippy --locked --all-targets -- -D warnings, cargo fmt --check and cargo test --package dynamic-fee-sharing pass.
• bun run test (16 passing, litesvm) with bun 1.4.2, after anchor build --ignore-keys with anchor-cli 1.0.2 and Solana 3.1.10 (platform-tools v1.52).
• actionlint 1.7.12 on dependency-audit.yml: no findings. The two rust-cache@v1 notes in ci.yml were already on main.