fix(deps): resolve cargo audit security advisories

[jrollin]

Resolves 4 of 6 vulnerabilities reported by cargo audit. All were transitive; none is a direct dependency of this workspace.

Results

Advisory	Crate	Old	New	Status
RUSTSEC-2026-0258	h2	0.4.15	0.4.16	Cleared
RUSTSEC-2026-0204	crossbeam-epoch	0.9.18	0.9.20	Cleared
RUSTSEC-2026-0195	quick-xml	0.38.4	removed	Cleared
RUSTSEC-2026-0194	quick-xml	0.38.4	removed	Cleared
RUSTSEC-2026-0195	quick-xml	0.37.5	0.37.5	Not fixed
RUSTSEC-2026-0194	quick-xml	0.37.5	0.37.5	Not fixed

cargo audit: 6 vulnerabilities -> 2. No new advisories appeared.

Changes

• h2 and crossbeam-epoch: lockfile-only bumps (cargo update -p), no manifest change needed.
• cartog 0.30.2 -> 0.32.2 with default-features = false.

The cartog default feature set includes remote-s3, which pulls rust-s3 -> aws-creds -> quick-xml 0.38. This workspace only uses cartog::db::Database and cartog::types (the local SQLite graph) and never uses S3, LSP, or embedding features, so disabling default features drops that path entirely rather than masking it. A comment in Cargo.toml records why, to stop the feature being re-enabled by accident.

No application code changes were required.

Left unfixed, with reason

quick-xml 0.37.5 reaches the tree through self_update 0.42.0, a mandatory (non-optional) dependency of cartog that pins quick-xml = "0.37". The fix requires >= 0.41.0, and:

• quick-xml is not feature-gated in self_update — its S3 backend is always compiled, so no feature flag removes it.
• The newest self_update (0.44.0) still requires only ^0.38, which is itself vulnerable. No published self_update release depends on a fixed quick-xml.
• A same-registry [patch] is rejected by Cargo, and forcing a multi-major 0.37 -> 0.41 bump under a crate not written against that API would not produce a tree that compiles.

This needs an upstream self_update release, then a cartog bump. Forcing it here was deliberately avoided rather than shipping a broken tree.

Out of scope (unchanged, warnings only)

number_prefix 0.4.0 (RUSTSEC-2025-0119) and paste 1.0.15 (RUSTSEC-2024-0436) remain unmaintained warnings, not vulnerabilities — same status as before this change.

Verification

• cargo build --all-targets — passes
• cargo test --workspace — 381 passed, 0 failed
• cargo fmt --check — clean
• cargo deny check advisories — FAILS on the two remaining quick-xml 0.37.5 advisories above; nothing else
• cargo clippy --workspace --all-targets -- -D warnings — 2 errors (redundant reference in println! argument), pre-existing: verified by stashing and re-running on clean main, which reproduces the identical 2 errors. Unrelated to dependencies and left untouched.

Summary by CodeRabbit

• Chores
  • Updated the underlying mapping component to a newer version.
  • Disabled its default optional features for a leaner configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d7d76746-1f51-4334-b357-25bcd72f3842

📥 Commits

Reviewing files that changed from the base of the PR and between fbb6679 and 4e35773.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• Cargo.toml

Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Cargo manifest updates cartog from version 0.30 to 0.32 and disables its default features.

Changes

Cartog dependency configuration

Layer / File(s)	Summary
Update cartog dependency features Cargo.toml	The cartog dependency uses version 0.32 with default-features = false.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 4e357

This PR updates transitive dependencies and disables unused default features without application-code changes; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies dependency updates intended to address Cargo audit security advisories.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/security-cargo-audit

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.64%. Comparing base (fbb6679) to head (4e35773).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #38   +/-   ##
=======================================
  Coverage   80.64%   80.64%           
=======================================
  Files          27       27           
  Lines        7540     7540           
=======================================
  Hits         6081     6081           
  Misses       1459     1459           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.