[brianluby]

• tokio 1.53.2 -> 1.53.3 (RUSTSEC-2026-0386, unsound AsyncFd constructors; Forge does not use AsyncFd); exception and vet exemption move to the fixed identity
• deny.toml: owner-approved ignore for RUSTSEC-2024-0449 (unsafe-libyaml via serde_yaml_ng), review by 2026-12-31
• Record decision 4 in the 2026-10-24 decision packet

Summary by CodeRabbit

• Chores
  • Updated the approved Tokio version and its security review record.
  • Recorded an approved exception for an unmaintained dependency advisory, with a review deadline.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: d9f96203-1208-4a52-9c8a-174fce439e49

Commits

Reviewing files that changed from the base of the PR and between dee0d57 and 8cbb487.

Files ignored due to path filters: 2

• Cargo.lock is excluded by !**/*.lock
• docs/plans/2026-10-24-dependency-renewal-and-update-decisions.md is excluded by !docs/**

Files selected for processing: 4

• deny.toml
• supply-chain/config.toml
• supply-chain/dependency-exceptions.json
• supply-chain/dependency-graph.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

The changes add an ignore entry for RUSTSEC-2024-0449 and update the Tokio supply-chain exception from version 1.53.2 to 1.53.3. The Tokio exception’s checksum and rationale also change.

Changes: Advisory ignore entry

Layer / File(s)	Summary
Document and ignore unsafe-libyaml advisory deny.toml	The advisory configuration ignores RUSTSEC-2024-0449. Comments record the dependency path, owner approval, and review deadline.

Tokio dependency exception

Layer / File(s)	Summary
Update Tokio exception supply-chain/config.toml, supply-chain/dependency-exceptions.json	The Tokio exemption and dependency exception now specify version 1.53.3. The exception checksum and rationale also change.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Possibly related PRs

• policy-forge/forge#245: Adds the Tokio 1.53.2 exemption and dependency exception that this change updates to 1.53.3.

Merge Risk: Minimal · up to 8cbb4

The supply-chain updates are internally consistent and introduce no established merge-blocking risk.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely summarizes both primary changes: updating Tokio to 1.53.3 and ignoring the unmaintained unsafe-libyaml advisory.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

Finishing Touches: 💡 1

⚔️ Resolve merge conflicts: 💡

• Resolve merge conflict in branch chore/dependency-renewal-2026-10-24

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the versions in a row,
Tokio hops to 1.53.3.
An advisory gets a note to show,
While yaml trails are clear to see.
The burrow files are set to go.}

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟢 Approval recommended

It is a low-risk, internally consistent supply-chain update with matching checksums across all files, verified-correct advisory IDs, and satisfied inventory-gate requirements.

No open issues 🎉

What changed in this PR

This PR performs routine supply-chain maintenance to keep cargo deny / cargo audit and the owned-exception gate green. It bumps tokio from 1.53.2 to 1.53.3 — the patched release for RUSTSEC-2026-0386 (unsound safe AsyncFd constructors; Forge does not use AsyncFd) — and adds an owner-approved deny.toml ignore for RUSTSEC-2024-0449 (unmaintained unsafe-libyaml, pulled transitively by serde_yaml_ng). It also records the rationale as "Decision 4" in the October 24 decision packet. This fits the repo's established pattern of binding each runtime identity to a fresh owned exception whose checksum equals the Cargo.lock checksum, with documented owner approval.

I verified the change is internally consistent: the new checksum ce3335… matches across Cargo.lock, dependency-exceptions.json, config.toml (cargo-vet exemption), the decision-doc table, and the regenerated dependency-graph.json; the old 1.53.2 checksum e95f91… is fully removed; both RUSTSEC IDs are correct; and the exception satisfies the inventory gate (checksum match + valid date ordering).

Changes:

• Update tokio to 1.53.3 in Cargo.lock, the owned exception, and the cargo-vet exemption, moving the RUSTSEC-2026-0386 remediation onto the fixed identity.
• Add an owner-approved deny.toml ignore for RUSTSEC-2024-0449 (unsafe-libyaml) with a 2026-12-31 review date, matching the existing ttf-parser entry style.
• Document the above as "Decision 4" in the 2026-10-24 decision packet.

File	Description
Cargo.lock	Bumps the resolved tokio entry to 1.53.3 with the new checksum.
supply-chain/​dependency-exceptions.json	Moves the owned exception to the 1.53.3 identity, updating checksum and rationale.
supply-chain/​config.toml	Updates the cargo-vet exemptions.tokio version to 1.53.3.
deny.toml	Adds the owner-approved RUSTSEC-2024-0449 ignore for unsafe-libyaml.
docs/​plans/​2026-10-24-dependency-renewal-and-update-decisions.md	Records Decision 4 and updates the decision count, table, and human-decision receipt.

_{Review effort: Balanced}

[brianluby]

Closing as superseded: this commit (8cbb487) already landed on main via #246 (cherry-picked as 42e7188) after #245 was merged one commit early. Every file in this PR matches main exactly except supply-chain/dependency-graph.json, where main is newer (refreshed for the later release.yml updates in #242/#243). That newer graph is the source of the merge conflict, and resolving it would leave an empty diff.