Affected components
- CLI TUI dependency path: ratatui 0.28.1 -> lru 0.12.5 (RUSTSEC-2026-0002 warning)
- Embedding/model dependency paths: fastembed 5.2.0 and hf-hub 0.4.3 -> tokenizers/ravif/indicatif transitive warnings for paste and number_prefix
Risk
cargo audit now reports zero vulnerabilities after the targeted maintenance update, but still reports allowed advisory warnings for unmaintained/unsound transitive crates. The remaining fixes likely require broader upgrades to ratatui, fastembed, hf-hub, tokenizers, or image/ravif dependency paths.
Impact
Leaving these warnings unresolved keeps audit output noisy and may mask future advisories. The lru warning is on a CLI UI dependency path, while paste/number_prefix are pulled through embedding/model support.
Proposed fix
Evaluate dependency upgrade paths for ratatui and the semantic embedding stack. Prefer versions that preserve semantic search defaults and avoid reintroducing the fastembed image/zune-jpeg stable-CI issue documented in Cargo.toml.
Suggested tests
- cargo audit
- cargo check --all-targets
- cargo clippy --all-targets -- -D warnings
- cargo test --all-targets -- --nocapture
- Manual smoke check for arrowhead index status TUI if ratatui changes
- Semantic indexing/search smoke test with embeddings enabled or a controlled model cache
Why not implemented automatically
This maintenance pass handled direct vulnerabilities with targeted lockfile updates. Resolving the remaining warnings requires broader dependency changes across UI and embedding/model crates with higher regression risk.
Affected components
Risk
cargo audit now reports zero vulnerabilities after the targeted maintenance update, but still reports allowed advisory warnings for unmaintained/unsound transitive crates. The remaining fixes likely require broader upgrades to ratatui, fastembed, hf-hub, tokenizers, or image/ravif dependency paths.
Impact
Leaving these warnings unresolved keeps audit output noisy and may mask future advisories. The lru warning is on a CLI UI dependency path, while paste/number_prefix are pulled through embedding/model support.
Proposed fix
Evaluate dependency upgrade paths for ratatui and the semantic embedding stack. Prefer versions that preserve semantic search defaults and avoid reintroducing the fastembed image/zune-jpeg stable-CI issue documented in Cargo.toml.
Suggested tests
Why not implemented automatically
This maintenance pass handled direct vulnerabilities with targeted lockfile updates. Resolving the remaining warnings requires broader dependency changes across UI and embedding/model crates with higher regression risk.