- rustfmt the integration-test FolderService::new callsites added during
the upstream merge (long single-line args wrapped).
- Cargo.lock: rebuild from upstream/main's lock so only the
testcontainers-modules dev-dep subtree and the memmap2 0.9.10→0.9.11
security bump differ (avoids churning upstream's pins).
- .cargo/audit.toml: ignore the four astral-tokio-tar tar-extraction
advisories — dev-only, transitive via testcontainers-modules
(integration-test harness), never in the production binary.
- and protect amount of properties
- azure_core 0.21.0 is using quick-xml 0.31.0 which is Dos-able
azure_core is no more maintained, would migrte to official azure lib
later
# rustls-webpki 0.101.7 — three advisories, all transitive via AWS SDK → rustls 0.21.12.
# aws-sdk-s3 1.x (latest) has not yet migrated to rustls 0.23.x; no upgrade path available.
# Severity: low — exploitation requires either a rogue CA or a MitM on AWS S3 infrastructure.
# RUSTSEC-2026-0104: DoS via panic in CRL parsing (only if CRLs are processed).
# RUSTSEC-2026-0098: URI name constraints ignored (requires CA misissuance).
# RUSTSEC-2026-0099: Wildcard name constraint bypass (requires CA misissuance).
"RUSTSEC-2026-0104",
"RUSTSEC-2026-0098",
"RUSTSEC-2026-0099",
# instant unmaintained — transitive via azure_core 0.21.0 (latest available).
# No direct security impact; no upgrade path exists.
"RUSTSEC-2024-0384",
- Update .gitignore to allow .cargo/config.toml while ignoring other .cargo contents
- Include the target-cpu=native config that was created in previous commit but missed due to .gitignore
Edouard Vanbelle