Rust Supply Chain

An audit that ends in a list of advisory IDs has done the easy half. The hard half is saying, per advisory, whether this repo actually reaches the vulnerable code path and what to do about it.

What this covers, and the one rule

Four questions: is anything we depend on known-vulnerable, is anything unmaintained, does every licence in the tree comply with the policy, and is the tree carrying weight it does not need. Read Cargo.lock as the authority on what is actually built — not Cargo.toml, which states ranges — and read the MSRV from docs/agents/rust.md, because a fix that bumps a dependency past the MSRV is not a fix. The rule: every finding ends in a decision — upgrade, replace, vendor, or accept with a written reason and an expiry. An unactioned advisory list is noise, and noise trains people to ignore the tool.

Two tools, overlapping on purpose