inspequte-cargo-audit-fix

Category: Testing & Security | Uploader: KengoTODA | Downloads: 0 | Version: v1.0（Latest）

Fix Rust dependency audit failures in inspequte by reading cargo audit SARIF output, updating Cargo.toml or Cargo.lock with minimal dependency changes, and verifying with cargo build, cargo test, and cargo audit.

Changelog: Source: GitHub https://github.com/KengoTODA/inspequte

Directory Structure

Current level: tree/main/.codex/skills/inspequte-cargo-audit-fix/

📁 agents/
- 📄 openai.yaml 252 B
📄 SKILL.md 2.5 KB

SKILL.md

---
name: inspequte-cargo-audit-fix
description: Fix Rust dependency audit failures in inspequte by reading cargo audit SARIF output, updating Cargo.toml or Cargo.lock with minimal dependency changes, and verifying with cargo build, cargo test, and cargo audit.
---

# inspequte cargo audit fix

## Inputs
- `cargo audit --format sarif` output, usually `target/audit-input/audit.sarif` or `target/audit.sarif`.
- `Cargo.toml` and `Cargo.lock`.
- The minimum surrounding files needed to understand dependency use.

## Outputs
- Minimal dependency updates in `Cargo.lock`.
- `Cargo.toml` updates only when a direct dependency constraint prevents resolving a fixed version.
- A clear final report listing fixed advisories and any unresolved manual follow-ups.

## Workflow
1. Read the SARIF report and identify each affected crate, current version, advisory ID, severity, and fixed version or patched range.
2. Prefer lockfile-only updates:
   - Run `cargo update -p <crate> --precise <fixed_version>` when SARIF or RustSec data gives one concrete fixed version.
   - If only a version range is available, choose the lowest compatible patched version.
3. Edit `Cargo.toml` only when the fixed version cannot be selected under the existing direct dependency requirement.
4. Keep changes narrowly scoped to the vulnerable dependency and resolver-required transitive updates.
5. Do not add compatibility shims, alternate dependency paths, or unrelated crate upgrades.
6. Run `cargo fmt` after code or manifest changes.
7. Verify with:
   - `cargo build`
   - `cargo test`
   - `cargo audit --format sarif`
8. If verification fails, continue only when the next step is clear from the error. Otherwise stop and report:
   - unresolved crate or advisory
   - attempted update
   - blocking error
   - required human decision

## Guardrails
- Treat the SARIF report as the source of truth for the audit failure being fixed.
- Prefer simplicity over backward compatibility.
- Do not update unrelated dependencies for freshness.
- Do not ignore advisories or add audit suppressions.
- Preserve Conventional Commit style when committing: `fix(deps): resolve cargo audit findings`.
- Use ASCII-only edits unless a touched file already requires Unicode.

## Definition of Done
- `cargo audit --format sarif` exits successfully.
- `cargo build` and `cargo test` pass.
- The diff is limited to dependency files unless source changes are necessary for the dependency update.
- Any unresolved advisory is documented with concrete evidence.

Comments 0

Latest | Hot

Please login before commenting.

Loading comments...

inspequte-cargo-audit-fix

Directory Structure

SKILL.md

Report

Notice