fix: resolve dfe test failures and advisory warnings

- Change dfe::tests to #[tokio::test] (MetricsManager::new needs a
  reactor when all-features enabled via hyper-util)
- Fix clippy cast warnings in worker_test.rs
- Add deny.toml ignore rules for unmaintained transitive deps
  (instant via reqwest-retry, paste via dtolnay)

Author: catinspace-au

deny.toml

@@ -4,6 +4,11 @@ all-features = true
 
 [advisories]
 yanked = "warn"
+# Transitive deps we cannot control — track upstream for resolution
+ignore = [
+    "RUSTSEC-2024-0384", # instant (via reqwest-retry → parking_lot 0.11)
+    "RUSTSEC-2024-0436", # paste (dtolnay crate, widely used, no replacement)
+]
 
 [licenses]
 allow = [

src/metrics/dfe.rs

@@ -511,14 +511,14 @@ impl DfeMetrics {
 mod tests {
     use super::*;
 
-    #[test]
-    fn test_register_does_not_panic() {
+    #[tokio::test]
+    async fn test_register_does_not_panic() {
         let mgr = super::super::MetricsManager::new("test_app");
         let _dfe = DfeMetrics::register(&mgr);
     }
 
-    #[test]
-    fn test_register_populates_registry() {
+    #[tokio::test]
+    async fn test_register_populates_registry() {
         let mgr = super::super::MetricsManager::new("test_app");
         let _dfe = DfeMetrics::register(&mgr);
         let manifest = mgr.registry().manifest();
@@ -549,8 +549,8 @@ mod tests {
         assert_eq!(auth.labels, vec!["reason"]);
     }
 
-    #[test]
-    fn test_methods_callable_without_recorder() {
+    #[tokio::test]
+    async fn test_methods_callable_without_recorder() {
         let mgr = super::super::MetricsManager::new("test_app");
         let dfe = DfeMetrics::register(&mgr);
 

tests/worker_test.rs

@@ -83,7 +83,7 @@ fn test_process_batch_executes_on_multiple_threads() {
     for (i, result) in results.iter().enumerate() {
         assert_eq!(
             *result.as_ref().unwrap(),
-            (i as i32) * 2,
+            (i32::try_from(i).unwrap()) * 2,
             "Wrong result at index {i}"
         );
     }
@@ -171,7 +171,10 @@ async fn test_fan_out_async_preserves_order() {
     let items: Vec<i32> = (0..20).collect();
     let results: Vec<Result<i32, String>> = pool
         .fan_out_async(&items, |&item| async move {
-            tokio::time::sleep(std::time::Duration::from_millis((20 - item as u64) % 10)).await;
+            tokio::time::sleep(std::time::Duration::from_millis(
+                u64::try_from(20 - item).unwrap_or(0) % 10,
+            ))
+            .await;
             Ok(item * 3)
         })
         .await;
@@ -180,7 +183,7 @@ async fn test_fan_out_async_preserves_order() {
     for (i, result) in results.iter().enumerate() {
         assert_eq!(
             *result.as_ref().unwrap(),
-            (i as i32) * 3,
+            (i32::try_from(i).unwrap()) * 3,
             "Result at index {i} has wrong value"
         );
     }