# Clear dependency advisories and gate releases

Type: task
Status: resolved

## Question

Remove every current `npm audit --omit=dev` high finding and every `cargo audit`
vulnerability/unsound finding through tested upgrades, compatible overrides or
upstream fixes—not ignores—and add reproducible Node and Rust security-audit
gates to CI and the production release evidence.

## Answer

All current production-high Node advisories and all Rust vulnerability/unsound
advisories are removed without advisory ignores:

- `@larksuiteoapi/node-sdk` 1.70.0 declares Axios `~1.13.3`, which prevented npm
  from selecting a patched release. The Hub now has a targeted npm override to
  Axios 1.18.1. The direct SDK stays current; the override is locked and the
  full Hub type/build/test gate validates the resolved tree. A deterministic
  local-HTTP smoke also drives the real SDK/Axios stack through tenant-token,
  authenticated success and HTTP-error paths without external credentials.
- `memmap2` is upgraded to 0.9.11 and `crossbeam-epoch` to 0.9.20.
- `plist` is upgraded to 1.10.0, which moves its XML parser to `quick-xml`
  0.41.0.
- crates.io `citationberg` 0.7.0 still pins vulnerable `quick-xml` 0.38.4.
  Cargo now patches it to the exact upstream citationberg commit that adopts
  `quick-xml` 0.41.0; the git revision is immutable in both manifest and lock.

`hub-check` runs the checked-in `npm run audit:production` command immediately
after `npm ci`. `checker-check` installs the pinned cargo-audit 0.22.2 release
with `--locked`, then runs `cargo audit --deny unsound`; vulnerabilities fail by
default and unsound warnings are promoted to failures.

Current evidence:

- `npm audit --omit=dev --audit-level=high`: 0 vulnerabilities.
- `cargo audit --deny unsound`: 0 vulnerabilities and 0 unsound warnings.
- Four Rust `unmaintained` informational warnings remain visible and are not
  ignored; they are outside this issue's vulnerability/unsound acceptance
  criterion and will continue to appear in CI output.
- Hub: type-check, build and 280 tests pass (10 environment-specific skips).
- Rust: fmt, clippy with warnings denied, and all 53 workspace tests pass.