# Stable dependencies and runtime review
Reviewed 2026-10-21 from fetched main. Initial paginated inventories contained two open dependency PRs (95 and 96) and zero open code-scanning alerts. No security alerts were dismissed. The rollup covers both PRs, updates Rust build/CI/release pins to official stable 1.99.1, updates all direct/dev crates and compatible locked dependencies, and refreshes current stable Action pins. Consumer MSRV 1.97.1 remains unchanged. Development pre-commit tooling moves to 4.7.0.
The CLI operates through Rust HTTP clients and the GitHub API, without requiring a shell, Git executable, or native binary-analysis ABI at runtime. Its container now deliberately adapts the audited static-musl pattern rather than claiming byte identity with a GNU template: all Cargo features stay enabled, maintained Alpine musl is selected explicitly instead of Rust's older bundled libc, and linker provenance/static PIE/no-shared-dependency checks guard the output. This avoids retaining affected glibc/GCC/zlib packages merely because the current alert inventory is empty.
The root image keeps its nonroot UID/GID 65532, `/home/nonroot` working directory, and `tini -- /usr/local/bin/app` entrypoint. `runtime/Dockerfile` retains its intentional `USER root` for GitHub's runner-owned workspace and file-command mounts. Its released-image pin remains on the latest stable published 0.7.8 image until a normal reviewed release publishes this replacement; source changes do not retroactively remediate older immutable images.
The final runtime receives maintained CA data and the exact installed supplier package record together, requiring Debian's fixed CA release. Validation checks removed distrust subjects, package provenance, both shipped ELF files, and actual system-musl linkage. A local HTTPS API fixture drives a real dry-run Action pin operation, verifies the resolved commit, checks untrusted/hostname certificate failures, and never requests or uses real GitHub credentials. Complete local CI, MSRV and image/scan results are recorded in the PR.
Sources: [official Rust stable manifest](https://static.rust-lang.org/dist/channel-rust-stable.toml), [crates.io sparse index](https://index.crates.io/config.json), [Rust self-contained linkage](https://doc.rust-lang.org/rustc/codegen-options/index.html#link-self-contained), [Debian CA advisory](https://www.debian.org/security/2026/dsa-6572). Action pins were resolved from the upstream repositories' current stable tags, retaining immutable SHAs.
The current container gate now includes unfixed advisories and fails on findings at every severity. The old package-scoped MiniZip ignore is removed because the maintained runtime supplies neither zlib nor MiniZip. Both native architectures upload independent complete results; AMD64 preserves its original analysis identity. No severity or unfixed filter conceals runtime detections. Full `make ci` and the unchanged Rust 1.97.1 MSRV check passed locally.
Workflow tool inputs are current as well as their Action wrappers: Trivy 0.76.0, Cosign 3.1.4, Syft 1.55.0, TruffleHog 3.99.3 and Gitleaks 8.30.1. Explicit inputs avoid the older defaults/overrides in current installer Actions.