[kixelated]

Problem

Nightly's Rust audit rejects RUSTSEC-2026-0173, and the root Bun audit still resolves vulnerable glob/minimatch versions despite existing root overrides. Completes quest/m0/nightly/audits.md and removes its file and link.

Approach

• Reapply the existing overrides with bun update glob minimatch --lockfile-only --ignore-scripts: glob 10.5.0 becomes 14.0.3 and both nested minimatch 9.0.9 resolutions join the shared 11.0.4. Only glob/minimatch and their dependency closures change. The obsolete glob CLI dependency subtree disappears; no unrelated package is upgraded.
• Ignore only RUSTSEC-2026-0173, as authorized by the quest Plan. moq-auth, moq-crypto, moq-hls and moq-cli reach it through rind's libcrux AES/ML-KEM/SHA3 stack, then libcrux-intrinsics 0.0.9 -> core-models 0.0.7 -> hax-lib 0.3.7 -> hax-lib-macros -> proc-macro-error2. The core-models edge is enabled only under cfg(hax), so it is absent from the normal host build. The ignored crate is a build-time proc macro.
• Keep the recurring dependency-audit notes accurate, including the parent ranges that still need the existing overrides and the condition for removing the Rust ignore.

Evidence

• Reproduced both real audit commands on unchanged main at dc0bd09b1114533f325376688e0d7dc1a6394da2 before editing: just rs audit fails only RUSTSEC-2026-0173; just js audit fails the root graph on the two advisories while all six standalone graphs pass.
• RustSec reports maintenance status rather than a vulnerability, with no patched version. The latest stable core-models 0.0.7 manifest still requires hax-lib 0.3.7; the latest stable libcrux-intrinsics 0.0.9 manifest still requires core-models 0.0.7 under cfg(hax). hax-lib-macros 0.4.2 already drops proc-macro-error2, but core-models' 0.3 requirement cannot select it. Confirmed registry releases and cargo tree --locked --all-features --target all -i proc-macro-error2.
• Upstream fixes are glob >=14.0.2 and minimatch >=11.0.1. Current stable unified-engine still declares glob 10; TypeDoc and vitepress-plugin-llms still declare minimatch 10. The existing TypeDoc compatibility patch is preserved.
• Checked refreshed open PR titles, bodies and branches, plus newer changed files. Nightly parent owns independent feature/audio continuation, not these audits. The supplied Rust update is closed; its replacement dependency group changes no libcrux/core-models/hax edge. No Rust upgrade is duplicated. The planning PR that put this quest on main is moq-dev/moq#7747; the supplied moq-dev/moq#7748 remains a separate open planning PR.

Impact

• Public API: none.
• Wire: none.
• Package versions and Cargo.lock: unchanged. No broader advisory suppression or harness change.

Alternatives

A stable Rust dependency upgrade cannot remove this edge yet, and overriding hax across its incompatible 0.x range would be unjustified. For JS, the existing overrides already express the required policy; a targeted resolution is sufficient, so no additional override, ignore or parent upgrade is added.

Validation

• just rs audit: pass after the change; advisory, license, ban and source policies all pass, with existing non-failing duplicate/license warnings.
• just js audit: all seven tracked Bun lockfiles pass.
• bun install --frozen-lockfile: pass, including the normal postinstall; leaves the lock unchanged.
• Matched each of the four changed lock entries' manifest and integrity to npm's published metadata. Confirmed every removed/changed resolution is inside the affected dependency closures, with only glob 14.0.3 and minimatch 11.0.4 remaining.
• quest check --base origin/main: pass, 593 documents. git diff --check origin/main...HEAD: pass.
• Final quest gate just ci: pass on the committed tree, including all selected JS checks/tests, the docs build and TypeDoc fixtures, Markdown, and GitHub tooling checks/tests. The initial run overlapped a final notes edit and failed the Markdown mirror comparison; the isolated Markdown check and this complete rerun pass.

Review

GPT-6.1 Sol, Codex harness, xhigh effort, local inspection of committed head 648a4b32a31d74cb277f4a4f394f3cd027b221eb. Other-vendor review skipped under quest-review's trivial-change exemption: generated dependency-lock repair, one explicitly authorized advisory ignore, and quest bookkeeping; no production source, API or wire change. Verified parent chains, registry manifests/integrities, unchanged existing policy and TypeDoc patch, lock closure boundaries, and real before/after audits. No subagents started.

Follow-ups

No new quest proposed. The recurring dependency audit owns removing the Rust ignore once core-models migrates and retiring each JS override when its parents declare safe ranges. No maintainer decision remains for this implementation.

(Written by GPT-6.1 Sol)

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 3 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 768d3572-c29e-4283-9799-5cfc278d4f18

Commits

Reviewing files that changed from the base of the PR and between 90081ff and 648a4b3.

Files ignored due to path filters: 1

• bun.lock is excluded by !**/*.lock

Files selected for processing: 4

• deny.toml
• quest/m0/nightly/README.md
• quest/m0/nightly/audits.md
• quest/m2/audit-deps.md

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[kixelated]

Automated review by review (OpenAI)

Reviewed head 648a4b3.

No actionable issue found. The Rust ignore is specific to the unmaintained proc macro and records its dependency path and removal condition; the Bun refresh keeps the existing overrides and consolidates the affected dependency resolutions.

Verification: GitHub-only static inspection of the advisory, dependency paths, upstream caller APIs, audit configuration and quest updates. I did not run the audits, dependency installation or tests.

(Written by review (OpenAI))

[pullfrog]

✅ No new issues found.

Reviewed changes

• Root Bun lock repair: bun.lock re-resolves glob to 14.0.3 and both nested minimatch 9.0.9 paths onto the shared 11.0.4 under the existing root overrides, moving only the glob/minimatch dependency closure.
• Rust advisory suppression: deny.toml ignores RUSTSEC-2026-0173 for build-time proc-macro-error2, reached only through libcrux-intrinsics's cfg(hax) edge.
• Quest bookkeeping: removes the completed nightly audits quest and its README link, and updates the recurring dependency-audit notes.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) ｜ 𝕏}