ENG2-P1-10: Dependency health: #704 security deps + RUSTSEC ignored-advisory burndown + dep dedup

[aram-devdocs]

Parent

• Program: ENG2 — GoudEngine v2 Rebuild (see the pinned master tracking issue)
• Phase / Milestone: Phase 1 — SDK Single Source of Truth (eng2-p1-sdk-truth)
• Batch / Group: Batch 1.3 — SDK reality & release cost / Group E
• Runbook spec: docs/src/runbook/phases/phase-1.md (committed with the roadmap)

Summary

Burn down dependency health debt: fold in #704's security dependency updates, reduce the ignored-RUSTSEC-advisory list in deny.toml from 8 entries to at most 2 (each with a written justification), and deduplicate duplicate crate versions across the workspace.

Architecture Context

Layer: Cross-cutting (workspace Cargo.toml/Cargo.lock/deny.toml) — not a single architectural layer; touches dependency graph health across all layers.
Modules/types touched:

• deny.toml — currently ignores 8 RUSTSEC advisories, including one involving anyhow UB; reduce to ≤ 2, each justified inline.
• Workspace Cargo.toml/Cargo.lock — resolve duplicate crate versions (multiple versions of the same crate pulled transitively) where feasible.
• Whatever 🚨 Security vulnerabilities found in Rust dependencies #704 already staged (check its current state/PR history before redoing work).

Boundary constraints (only those that apply):

• No suppression pragma without an inline justification: an unexplained #[allow(..)]/ignored advisory is treated as a defect (.agents/rules/documentation-standards.md). Each remaining deny.toml ignore entry must carry a comment explaining why it's currently unavoidable.
• Do not silently bump a dependency in a way that changes engine behavior across a layer boundary — if a security-driven bump changes an API surface (e.g. a crate used inside libs/graphics/backend/), verify the boundary rules in .agents/rules/graphics-patterns.md/ffi-patterns.md still hold post-bump.

Pattern to follow: the existing cgmath advisory-ignore precedent (git log shows "chore(deps): ignore new cgmath advisories (#704)") — every ignore entry should look like that: a specific, dated, justified line, not a blanket ignore.

Scope

• Review 🚨 Security vulnerabilities found in Rust dependencies #704's current state (open PR, merged partial work, or still-open issue) and fold its remaining security dependency updates into this issue rather than duplicating already-completed work.
• Audit all 8 currently-ignored RUSTSEC advisories in deny.toml; for each, determine: (a) can it be resolved by a version bump now, (b) is it transitively unavoidable and needs a justified long-term ignore, or (c) is the flagged crate itself removable (e.g. cgmath, tracked separately in ENG2-P8-08, so may already be trending toward removal — do not duplicate that migration here, just note the advisory's disposition).
• Resolve as many advisories as possible via version bumps; reduce the ignore list to ≤ 2 entries, each with an inline comment justification.
• Identify and deduplicate duplicate crate versions in the workspace (cargo tree --duplicates or equivalent) where a straightforward version alignment is possible without breaking builds.
• Tests: cargo deny check (or equivalent) passes with the reduced ignore list; full workspace build/test suite green after dependency bumps.
• Docs/rules updates: none expected beyond the inline deny.toml justification comments themselves — this issue's "docs" output IS those comments.

Acceptance Criteria

• RUSTSEC ignore list in deny.toml is ≤ 2 entries, each with a written inline justification (this is the literal Phase 1 gate item).
• 🚨 Security vulnerabilities found in Rust dependencies #704's security dependency work is completed/merged as part of this issue (or verified already resolved, with the issue closed/linked).
• Duplicate crate versions are reduced where a safe alignment exists (document any that remain duplicated for a valid reason, e.g. major-version-incompatible transitive deps).
• cargo check && cargo fmt --all -- --check && cargo clippy -- -D warnings clean; cargo test green; ./codegen.sh && git diff --exit-code (drift gate); cargo deny check (or repo-equivalent) green.

Breaking Change & Throne Follow-up

None expected — dependency version bumps should be internal unless a bump forces a semver-breaking API change in engine code that consumes the bumped crate. If any such forced change occurs, name it here explicitly and file the throne_ge follow-up; default assumption is None — internal dependency hygiene.

Blocked By

None.

Files Likely Touched

• Modified: deny.toml, workspace Cargo.toml, Cargo.lock, and any source files whose code must adapt to a bumped dependency's API changes

Agent Notes

• 8 ignored RUSTSEC advisories exist in deny.toml today, including one involving anyhow UB (roadmap-inputs.md W7 / design-technical.md P1-10) — this is a real security-posture gap, not cosmetic.
• Recent commit history already shows movement in this area: 8e58d857 Merge pull request #705 from aram-devdocs/overhaul/gate-cleanup-perf-groundwork and 42562f1a chore(deps): ignore new cgmath advisories (#704) — check what 🚨 Security vulnerabilities found in Rust dependencies #704/chore: engine cleanup, canonical gate, and perf groundwork #705 actually landed before starting the audit, since some of this issue's scope may already be partially done. Do not assume the roadmap doc's "8 ignored advisories" count is still accurate; re-verify against the current deny.toml.
• cgmath is separately tracked for full removal in ENG2-P8-08 (Phase 8) — if cgmath advisories are part of the 8, note their disposition here but do not attempt the full cgmath → core/math migration in this issue; that is explicitly a later, larger, differently-scoped issue.
• The disposition map in design-technical.md section 12 explicitly routes "🚨 Security vulnerabilities found in Rust dependencies #704 security deps → ENG2-P1-10" — this issue is that routing's execution.

Verification

cargo check && cargo fmt --all -- --check && cargo clippy -- -D warnings
cargo test
./codegen.sh && git diff --exit-code
cargo deny check
# spec test: goud_engine/tests/spec/eng2_p1_10_dependency_health.rs (or CI-level check if no Rust surface applies)