[mariusmm]

Why

The `lint` (cargo-deny) and `mcp-tests` (npm audit) jobs fail on every open PR (#420, #421, #422, #424), independent of their content.

Changes

• tokio 1.54.0 → 1.54.1 — RUSTSEC-2026-0384 (`Interval` race)
• ctutils 0.4.2 → 0.4.6 — RUSTSEC-2026-0385
• yoke-derive 0.8.3 → 0.8.4 — was yanked
• mcp-server: `npm audit fix` — body-parser (high), fast-uri, ip-address
• deny.toml: ignore RUSTSEC-2026-0387 (crypto-bigint 0.5.5). The fix needs ≥ 0.7.6, but `elliptic-curve` 0.13 pins 0.5 via `openidconnect` 4.0.1 (latest). Marreq only verifies ES256/ES384 ID-token signatures with public keys.

Needs a decision

The 0387 ignore is a judgement call. Drop it if you'd rather keep `lint` red until `openidconnect` moves to a newer RustCrypto release.

Verification (local)

• `cargo deny check advisories` → ok
• `cargo check --locked --workspace` → ok
• `npm audit` → 0 vulnerabilities; `npm test` → 51 passed

Supersedes #422 (tokio bump). Does not touch #424's own failures (contract drift, missing oasdiff).

🤖 Generated with Claude Code

[github-actions]

Frontend SPA coverage (by module)

Module	Line Rate	Branch Rate	Function Rate	Health
api	89.1% (311 / 349)	82.7%	86.0%	✔
components	74.1% (2234 / 3015)	62.6%	70.5%	➖
components/graph	100.0% (9 / 9)	66.7%	100.0%	✔
components/reports	86.1% (87 / 101)	70.6%	74.1%	✔
components/table	100.0% (7 / 7)	80.0%	100.0%	✔
context	77.8% (56 / 72)	40.0%	69.6%	➖
hooks	72.3% (146 / 202)	71.1%	70.0%	➖
lib	100.0% (18 / 18)	100.0%	100.0%	✔
pages	68.7% (2331 / 3392)	55.5%	61.0%	➖
pages/catalog	34.8% (162 / 465)	24.5%	18.3%	❌
pages/groups	0.0% (0 / 219)	0.0%	0.0%	❌
src (root)	33.3% (8 / 24)	38.1%	60.0%	❌
types	100.0% (0 / 0)	100.0%	100.0%	✔
utils	97.2% (620 / 638)	89.1%	98.8%	✔
Summary	70.4% (5989 / 8511)	59.1%	65.1%	➖

Generated from Vitest @vitest/coverage-v8 (frontend/src).

[github-actions]

Package	Line Rate	Complexity	Health
marreq-core.src	80%	0	✔
marreq-core.src.api	83%	0	✔
marreq-core.src.fairings	90%	0	✔
marreq-cloud.src.fairings	100%	0	✔
marreq-core.src.models	80%	0	✔
marreq-core.src.reqif	97%	0	✔
marreq-core.src.services	93%	0	✔
marreq-core.src.services.semantic_search	75%	0	➖
marreq-cloud.src	71%	0	➖
marreq-cloud.src.services	91%	0	✔
marreq-core.src.auth.guards	57%	0	➖
marreq-core.src.repository.diesel_repo	5%	0	❌
marreq-core.src.helper_functions	95%	0	✔
marreq-core.src.diff	100%	0	✔
marreq-cloud.src.api	78%	0	✔
marreq-core.src.deployment	84%	0	✔
marreq-core.src.importers	74%	0	➖
marreq-core.src.reports	95%	0	✔
marreq-core.src.repository.cache	100%	0	✔
marreq-core.src.repository	88%	0	✔
marreq-core.src.routes	61%	0	➖
marreq-core.src.storage	93%	0	✔
marreq-core.src.use_case_document	94%	0	✔
marreq-server.src	57%	0	➖
marreq-core.src.generators	90%	0	✔
marreq-core.src.auth	90%	0	✔
marreq-core.src.validation	96%	0	✔
marreq-core.src.auth.rate_limiter	73%	0	➖
Summary	81% (45266 / 56209)	0	✔