Context
DROID read-only audit reported RustSec warnings in the GUI/TUI dependency tree: GTK/tray related advisories through tray-icon, lru through ratatui, and other transitive warnings such as bincode, paste, number_prefix depending on the resolved graph.
Scope
- Run
cargo audit --no-fetch --stale or current equivalent and capture the exact active advisories.
- Inspect
Cargo.toml dependency posture for GUI/TUI dependencies.
- Prefer safe dependency updates if they are low-risk and within current public behavior.
- If a warning cannot be fixed without a larger migration, document the mitigation and create follow-up tasks.
- Do not remove GUI/TUI functionality without explicit follow-up approval.
Acceptance Criteria
- Current RustSec warnings are listed with cause, reachability, and proposed action.
- Low-risk dependency updates are applied if available.
- Remaining warnings have explicit mitigation/follow-up notes.
cargo test --locked passes.cargo clippy --all-targets -- -D warnings passes.cargo fmt --check passes.- If GUI dependencies are changed:
cargo build --features gui --locked passes.
Audit Reference
Reported from read-only DROID audit: Cargo.toml GUI/TUI dependency tree and cargo audit warnings.
Context
DROID read-only audit reported RustSec warnings in the GUI/TUI dependency tree: GTK/tray related advisories through
tray-icon,lruthroughratatui, and other transitive warnings such asbincode,paste,number_prefixdepending on the resolved graph.Scope
cargo audit --no-fetch --staleor current equivalent and capture the exact active advisories.Cargo.tomldependency posture for GUI/TUI dependencies.Acceptance Criteria
cargo test --lockedpasses.cargo clippy --all-targets -- -D warningspasses.cargo fmt --checkpasses.cargo build --features gui --lockedpasses.Audit Reference
Reported from read-only DROID audit:
Cargo.tomlGUI/TUI dependency tree andcargo auditwarnings.