Problem: `cargo audit` reported 16 vulnerabilities and 29 warnings over
the lockfile, none in a declared crate. Certificate validation
(`rustls-webpki`) and archive unpacking (`tar`) were both affected. The
`libsqlite3-sys = "0.28"` pin additionally held `sqlx` at 0.8.0, which
carries RUSTSEC-2024-0363 — `links = "sqlite3"` permits one version
graph-wide, and `sqlx-sqlite` 0.8.1+ requires `^0.30.1`.
Solution: move the eleven affected crates to patched versions, leaving
3 vulnerabilities and 25 warnings. `libsqlite3-sys` goes to 0.30, the
only range diesel and `sqlx-sqlite` share, which bundles SQLite 3.46.0
in place of 3.45.0. `plist` 1.10 collapses two `quick-xml` copies into
one 0.41.0. What remains has no fix reachable here and compiles into no
macOS build: two `quick-xml` advisories behind a windows-gated
`tauri-winrt-notification`, and `rsa` with no upstream patch.
`cargo audit` joins the dev shell so those counts are reproducible.
![prelint[bot]](https://avatars.githubusercontent.com/in/2822344?s=60&v=4){kind=small}
Summary
cargo auditreported 16 vulnerabilities and 29 warnings over the lockfile, none in a declared crate. Certificate validation (rustls-webpki) and archive unpacking (tar) were both affected. Thelibsqlite3-sys = "0.28"pin additionally heldsqlxat 0.8.0, which carries RUSTSEC-2024-0363 —links = "sqlite3"permits one version graph-wide, andsqlx-sqlite0.8.1+ requires^0.30.1.This PR moves the eleven affected crates to patched versions, leaving 3 vulnerabilities and 25 warnings:
libsqlite3-sysgoes to 0.30, the only range diesel andsqlx-sqliteshare, which bundles SQLite 3.46.0 in place of 3.45.0.plist1.10 collapses twoquick-xmlcopies into one 0.41.0.quick-xmladvisories behind a windows-gatedtauri-winrt-notification, andrsawith no upstream patch.cargo auditjoins the dev shell so those counts are reproducible.Test Plan
cargo auditbefore/after: 16 vulnerabilities / 29 warnings → 3 / 25, with the remainder accounted for aboveCargo.lockhunk traced to one of the eleven intended bumps; no unrelated churn, and no bumped or added crate introduces a new advisorycargo test: 1204 passed, 0 failedcargo clippy --all-targets: cleancargo check --locked(CI's exact command): cleannixmac.db: the 3.45-era file opens in place under bundled SQLite 3.46.0,user_versionunchanged, no recreate. (Between 0.28 and 0.30.1 the only compile-flag delta is the obsolete no-op-DSQLITE_ENABLE_STAT2.)Docs