SECURITY-SWEEP-7 — The cargo-audit CI job's rationale comment understates the production dependency surface by seven crates, five of them cryptographic
Location: .github/workflows/ci.yml:60-64 (the sentence is on lines 61-63; line 59 is blank) · Severity: SMELL · Category: security
What the code does. The comment justifying the scope of the supply-chain gate reads: "Currently the root crate ships with only xxhash-rust and libc as production deps — both well-maintained — so the practical risk surface is small." The root [dependencies] block in Cargo.toml now lists nine: xxhash-rust, libc, rustc-hash, chacha20poly1305, argon2, hkdf, sha2, zeroize (pinned ~1.8), and getrandom, plus a floor-pinned transitive base64ct = "~1.6". The Cargo.toml comment on the crypto block correctly notes "they are unconditional deps (the seal/open code is always compiled)".
Why it is a problem. The comment is the recorded reason for how much supply-chain tooling this repo runs, and it is now false in the direction that matters: the crate's audit surface grew to include the entire RustCrypto AEAD/KDF stack, and two of those deps (zeroize, base64ct) are deliberately held below their current releases to preserve the 1.82 MSRV — pins that will age into advisory exposure and that this comment gives no reason to revisit. A reader deciding whether cargo audit alone is sufficient (there is no deny.toml, so there is no license or duplicate-version or ban gating) will make that call from a two-dep picture that has not been true since encryption landed.
Direction of a fix. Update the comment to reflect the current nine-dependency surface and call out the two MSRV-motivated downgrade pins as items to re-check when the floor moves past 1.85. Separately worth a decision: whether cargo deny should join cargo audit now that the tree pulls a full crypto stack.
Filed from the clean-slate deep review of 2026-07-29. Full context, verification notes, and the delta against ISSUES.md are in docs/reviews/review-20260729-183138.md. Baseline at review time: 681 tests passing, clippy and fmt clean — none of these are toolchain-visible.
SECURITY-SWEEP-7 — The cargo-audit CI job's rationale comment understates the production dependency surface by seven crates, five of them cryptographic
Location:
.github/workflows/ci.yml:60-64 (the sentence is on lines 61-63; line 59 is blank)· Severity: SMELL · Category: securityWhat the code does. The comment justifying the scope of the supply-chain gate reads: "Currently the root crate ships with only
xxhash-rustandlibcas production deps — both well-maintained — so the practical risk surface is small." The root[dependencies]block in Cargo.toml now lists nine:xxhash-rust,libc,rustc-hash,chacha20poly1305,argon2,hkdf,sha2,zeroize(pinned~1.8), andgetrandom, plus a floor-pinned transitivebase64ct = "~1.6". The Cargo.toml comment on the crypto block correctly notes "they are unconditional deps (the seal/open code is always compiled)".Why it is a problem. The comment is the recorded reason for how much supply-chain tooling this repo runs, and it is now false in the direction that matters: the crate's audit surface grew to include the entire RustCrypto AEAD/KDF stack, and two of those deps (
zeroize,base64ct) are deliberately held below their current releases to preserve the 1.82 MSRV — pins that will age into advisory exposure and that this comment gives no reason to revisit. A reader deciding whethercargo auditalone is sufficient (there is no deny.toml, so there is no license or duplicate-version or ban gating) will make that call from a two-dep picture that has not been true since encryption landed.Direction of a fix. Update the comment to reflect the current nine-dependency surface and call out the two MSRV-motivated downgrade pins as items to re-check when the floor moves past 1.85. Separately worth a decision: whether
cargo denyshould joincargo auditnow that the tree pulls a full crypto stack.Filed from the clean-slate deep review of 2026-07-29. Full context, verification notes, and the delta against
ISSUES.mdare indocs/reviews/review-20260729-183138.md. Baseline at review time: 681 tests passing, clippy and fmt clean — none of these are toolchain-visible.