From 60cc83c8225fde77a5abdadb4e4fd657664ea4fc Mon Sep 17 00:00:00 2001 From: "@permadeath.com" Date: Thu, 3 Sep 2026 01:22:10 -0400 Subject: [PATCH] fix(deps): pin url as a shared workspace dependency `didbot-tls` and `didbot-verify` each declared their own `url = "2"`, which `claude/dependency-audit`'s `workspace-dependencies` lint refuses once both branches are in one tree. One pin in `[workspace.dependencies]`, both crates pointing at it. Co-Authored-By: Claude Opus 5 (1M context) Change-Id: I830c4c3eae0dc997fa7359c1abdfcd7ce8925580 --- Cargo.toml | 5 +++++ crates/didbot-tls/Cargo.toml | 2 +- crates/didbot-verify/Cargo.toml | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 151c99ed..3f5213ac 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -96,6 +96,11 @@ tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt", "time"] time = { version = "0.3", features = ["formatting", "parsing", "macros"] } toml = "0.9" tower = { version = "0.5", features = ["util", "limit", "make"] } +# Two crates parse URLs directly -- `didbot-tls` for the ACME directory and +# `didbot-verify` for an ownership claim's endpoint -- so the version is +# pinned here rather than per-crate, the way every other shared dependency +# is. +url = "2" # PKCE's `S256` challenge is base64url, no padding — RFC 7636 §4.2. base64 = "0.22" # `default-features = false` plus an explicit `ring` here, not the default diff --git a/crates/didbot-tls/Cargo.toml b/crates/didbot-tls/Cargo.toml index 96e7f526..aaa4c7db 100644 --- a/crates/didbot-tls/Cargo.toml +++ b/crates/didbot-tls/Cargo.toml @@ -25,7 +25,7 @@ thiserror.workspace = true time.workspace = true tokio.workspace = true tracing.workspace = true -url = "2" +url.workspace = true x509-parser.workspace = true [dev-dependencies] diff --git a/crates/didbot-verify/Cargo.toml b/crates/didbot-verify/Cargo.toml index 53838e65..deb0a7d3 100644 --- a/crates/didbot-verify/Cargo.toml +++ b/crates/didbot-verify/Cargo.toml @@ -29,7 +29,7 @@ tokio.workspace = true # trailing dot and a trailing slash are spellings, and a byte compare over # them let a server escape the shared-host refusal. Already in the graph via # reqwest and `didbot-tls`. -url = "2" +url.workspace = true [lints] workspace = true -- 2.51.2