[OneNoted]

Summary

• narrow ratatui to the explicit features Prism-TUI uses
• regenerate Cargo.lock so the unused ratatui-termwiz/termwiz chain is removed
• drop the transitive rand 0.8.5 path flagged by Dependabot (GHSA-cq8v-f236-94qc)

Root cause

ratatui was being pulled in with its default feature set. That allowed Cargo to resolve the optional termwiz backend into Cargo.lock, which in turn pulled phf_generator and vulnerable rand 0.8.5 even though Prism-TUI only uses the crossterm backend.

Validation

• cargo audit
• cargo test

Greptile Summary

This PR fixes the Dependabot GHSA-cq8v-f236-94qc advisory by disabling ratatui's default features and explicitly selecting only the crossterm backend and widget features the project actually uses, which breaks the transitive dependency chain ratatui → ratatui-termwiz → termwiz → phf_generator → rand 0.8.5. The lock file regeneration confirms the removal of the entire termwiz/phf/rand 0.8.5 subtree.

Confidence Score: 5/5

Safe to merge — correctly removes the vulnerable rand 0.8.5 transitive dependency with no functional regressions.

All four ratatui features selected are valid for 0.30, the termwiz/phf/rand chain is fully eliminated from the lock file, and the PR author validated with cargo audit and cargo test. No P0/P1 findings.

No files require special attention.

Important Files Changed

Filename	Overview
Cargo.toml	Adds explicit feature selection for ratatui 0.30 with default-features = false; all four chosen features (crossterm_0_28, all-widgets, macros, layout-cache) are valid for ratatui 0.30 and align with the project's crossterm 0.28 dependency.
Cargo.lock	Regenerated lock file removes the full termwiz/phf/rand 0.8.5 chain; ratatui-termwiz, termwiz, phf_generator, rand 0.8.5, and ~40 other transitive crates are dropped as expected.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["prism-tui"] -->|"ratatui = 0.30\n(default features)"| B["ratatui 0.30"]
    A -->|"AFTER: default-features = false\nfeatures = [crossterm_0_28, all-widgets,\nmacros, layout-cache]"| B2["ratatui 0.30"]

    subgraph BEFORE["❌ BEFORE (vulnerable chain)"]
        B --> C["ratatui-termwiz"]
        C --> D["termwiz"]
        D --> E["phf_generator"]
        E --> F["rand 0.8.5\n⚠️ GHSA-cq8v-f236-94qc"]
    end

    subgraph AFTER["✅ AFTER (clean)"]
        B2 --> G["ratatui-crossterm\n(crossterm 0.28 + 0.29)"]
        B2 --> H["ratatui-widgets"]
        B2 --> I["ratatui-macros"]
    end

    style BEFORE fill:#fdd,stroke:#f66
    style AFTER fill:#dfd,stroke:#6a6
    style F fill:#f66,color:#fff

Loading

_{Reviews (1): Last reviewed commit: "fix: address dependabot rand alert" | Re-trigger Greptile}