Dependabot merges update lockfiles but never the inventory, so it had
drifted: gridstack was recorded at 11.5.1 and vite at 8.2.1, the agent
still listed tonic 0.12 and toml 0.8, and alerting -- named in the
audit's methodology -- had no rows at all.
Regenerated with the audit's own tools against this tree: cargo deny
list for agent and search, go-licenses csv per Go module, license-checker
for web. 52 versions bumped, 71 rows added, 55 gone, 786 -> 802 rows.
Everything added is permissive (MIT, Apache-2.0, BSD-3-Clause, Zlib or
an OR of those), so nothing is newly flagged; flagged rows go 36 -> 35
because ryu (Apache-2.0 OR BSL-1.0) left search's graph with reqwest
0.13. No bumped crate changed its license.
Built on the rustls update, so agent records rustls 0.23.45 and no
longer lists rustls-pemfile.
As last time, rows whose name and version are unchanged are left
byte-for-byte alone -- 679 of them -- so the diff is only the real
change. That also keeps every hand-written row: the segmentio/asm MIT-0
confirmations, the fonts, the favicon, and the three Docker images.
First-party github.com/cairnobs/cairnobs packages are left out, as
before. New rows follow the conventions the existing ones use, which
the regeneration reproduced exactly for every unchanged Rust and npm
row.
Signed-off-by: John Coffey <[email protected]>
jcoffey-dev
764b09cb14