jlxq0/withings-mcp
Watch
1
0
Fork
You've already forked withings-mcp
 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

fix: qualify fixed SHA-2, MCP and telemetry dependencies #8

Merged
jlxq0 merged 2 commits from fix/dependency-gates-20261029 into main 2026-10-29 01:05:16 +00:00
Conversation 0 Commits 2 Files changed 5 +121 -61
jlxq0 commented 2026-10-29 01:00:17 +00:00
Owner

The old lock passed RustSec while OSV reported six advisory entries in block-buffer, OpenTelemetry SDK and RMCP. This updates the released SHA-2/digest chain, aligns telemetry dependencies and moves RMCP to the fixed 2.2 line, without changing production Rust code or suppressing findings. A checksum-pinned OSV check now runs with the existing daily and source CI checks.

Standard SHA-256 vectors guard bearer/audit-key compatibility. All120 tests pass on the declared Rust1.93 MSRV; format/Clippy1.98, RustSec, OSV (265 crates), and dependency license/source checks pass. Two fresh independent Claude reviews completed; the final exact head7077e14a2f32606fab4308c327422517f2c45c5a is approved conditional on exact-head remote CI. Public fixtures remain synthetic; no provider calls or data writes occurred.

This is a source prerequisite, separate from the merged privacy-test capture fix. The fixed runtime image, immutable release/provenance, native client and same-account readback gates remain required before production promotion. Existing token-rotation, session, auth and privacy tests are retained.

The old lock passed RustSec while OSV reported six advisory entries in block-buffer, OpenTelemetry SDK and RMCP. This updates the released SHA-2/digest chain, aligns telemetry dependencies and moves RMCP to the fixed 2.2 line, without changing production Rust code or suppressing findings. A checksum-pinned OSV check now runs with the existing daily and source CI checks. Standard SHA-256 vectors guard bearer/audit-key compatibility. All120 tests pass on the declared Rust1.93 MSRV; format/Clippy1.98, RustSec, OSV (265 crates), and dependency license/source checks pass. Two fresh independent Claude reviews completed; the final exact head7077e14a2f32606fab4308c327422517f2c45c5a is approved conditional on exact-head remote CI. Public fixtures remain synthetic; no provider calls or data writes occurred. This is a source prerequisite, separate from the merged privacy-test capture fix. The fixed runtime image, immutable release/provenance, native client and same-account readback gates remain required before production promotion. Existing token-rotation, session, auth and privacy tests are retained.
test: close dependency qualification evidence and version floor
All checks were successful
CI / cargo (pull_request) Successful in 1m5s
Details
CI / docker (pull_request) Successful in 53s
Details
7077e14a2f
jlxq0 merged commit ec9829c18d into main 2026-10-29 01:05:16 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jlxq0/withings-mcp!8
No description provided.