Commit fd13593
chore(deps): strip phantom bincode dep, closes RUSTSEC-2025-0141
The `bincode = { version = "1.3", optional = true }` declaration in the
root `Cargo.toml` (with a `fast-serde = ["bincode"]` feature flag) was
never imported in any `.rs` file. Removing both the dependency and the
dead feature flag (plus its mention in `full`) closes
RUSTSEC-2025-0141 (`bincode@1.3.3`, advisory: bincode 1.x maintenance
sunset) at the source — no behavioural change because nothing in the
crate ever invoked the bincode API.
Verification:
$ grep -rE 'bincode' --include='*.rs' . # (no matches)
$ cargo update
$ grep -c '^name = "bincode"$' Cargo.lock # 0
`cargo check --lib` is green (4 pre-existing bin errors in src/main.rs
are unrelated — they reference `Orchestrator` methods that don't exist
on main; out of scope for this CVE strip).
Closes #33.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>1 parent 139ee5b commit fd13593
2 files changed
Lines changed: 423 additions & 225 deletions
0 commit comments