fix(security): resolve cargo audit dependency advisories

[hyperpolymath]

Summary

Resolves #100 by fixing the dependency graph reported by cargo audit.

Changes

• Correct the root Cargo.toml criterion constraint from 0.5 to 0.8.2. The lockfile had already selected criterion 0.8.2, but fresh resolution could downgrade it and reintroduce the affected dependency graph.
• Upgrade crossbeam-epoch from 0.9.18 to 0.9.20, resolving RUSTSEC-2026-0204.
• Upgrade anyhow from 1.0.101 to 1.0.103, resolving RUSTSEC-2026-0190.
• Keep the lockfile update targeted to avoid unrelated dependency churn.

Verification

• cargo metadata --locked --no-deps --format-version 1
• cargo test --workspace --locked
• cargo build --release --workspace --locked
• cargo fmt --all -- --check
• RUSTFLAGS=-Dwarnings cargo clippy --workspace --locked -- -D warnings
• cargo audit --deny warnings
• cargo audit --deny unmaintained

All checks pass locally.

[coderabbitai]

Understand this PR’s impact

Explore downstream dependencies and potential security impact with Blast Radius.

View blast radius →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a4f01f5b-4f1f-4923-8fdb-dc22675db4c6

📥 Commits

Reviewing files that changed from the base of the PR and between faebc86 and a88967f.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• Cargo.toml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (30)

• GitHub Check: scan / shell-secrets
• GitHub Check: scan / rust-secrets
• GitHub Check: scan / gitleaks
• GitHub Check: governance / Debt ratchet
• GitHub Check: governance / Actions lockfile verify
• GitHub Check: governance / Guix packaging policy (Nix retired)
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Live Actions policy (credentialed advisory)
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Allowlist Preflight
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Exemption ratchet
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Security policy checks
• GitHub Check: rust-ci / Detect Cargo.toml
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: Build Release
• GitHub Check: Test
• GitHub Check: Check
• GitHub Check: Clippy
• GitHub Check: Format
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: Validate DEED manifests
• GitHub Check: analyze (actions, none)
• GitHub Check: Groove manifest check
• GitHub Check: Validate K9 contracts
• GitHub Check: audit

🔇 Additional comments (1)

Cargo.toml (1)

46-46: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated an internal development dependency while retaining HTML reporting support.

Walkthrough

The pull request upgrades the Cargo development dependency criterion from 0.5 to 0.8.2. The html_reports feature remains enabled.

Changes

Criterion upgrade

Layer / File(s)	Summary
Update Criterion version Cargo.toml	The development dependency now uses criterion version 0.8.2 and retains the html_reports feature.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Bug fix

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the dependency advisory remediation, which matches the pull request objective.
Description check	✅ Passed	The description explains the dependency updates, audit findings, issue reference, and verification steps. It is directly related to the changeset.
Linked Issues check	✅ Passed	The description references issue #100 and explains how the pull request resolves its dependency audit requirements.
Out of Scope Changes check	✅ Passed	The visible change updates the root Cargo.toml dependency constraint. The stated lockfile updates and dependency upgrades support the declared security objective.
Linked Issues check	✅ Passed	The pull request addresses the coding objective in #100. It updates the dependency graph used by cargo audit, including crossbeam-epoch from 0.9.18 to 0.9.20 for RUSTSEC-2026-0204 and anyhow…
Out of Scope Changes check	✅ Passed	The reported changes are limited to dependency declarations, the targeted dependency lockfile update, and verification activities. These changes directly support the vulnerability remediation required…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the Cargo file
Criterion hops ahead in style
Reports still bloom in HTML light
The version number now feels right
One small change completes the trail}

_{Comment @coderabbitai help to get the list of available commands.}