Fixes CI and Build issues (#89)

.github/workflows/audit.yml

@@ -22,10 +22,12 @@ jobs:
     continue-on-error: true
     steps:
       - uses: actions/checkout@v4
-      - uses: taiki-e/install-action@cargo-audit
       - uses: rustsec/audit-check@v2
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
+          # quick-xml < 0.41.0: no upstream fix in wayland-scanner 0.31.x,
+          # zbus_xml 5.1.x, or xcb 1.7.0 (via zed-scap). Remove once patched.
+          ignore: RUSTSEC-2026-0194,RUSTSEC-2026-0195
 
   # cargo-deny: license compliance + advisory + duplicate detection
   cargo-deny:

.github/workflows/ci.yml

@@ -99,6 +99,15 @@ jobs:
       - uses: uncenter/setup-taplo@v1
       - run: taplo fmt --check
 
+  # Lockfile freshness
+  lockfile:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - name: Check Cargo.lock is up to date
+        run: cargo update && git diff --exit-code Cargo.lock
+
   # Unused dependencies
   machete:
     runs-on: ubuntu-latest
@@ -237,6 +246,7 @@ jobs:
       - clippy
       - typos
       - taplo
+      - lockfile
       - machete
       - msrv
       - check-wasm
@@ -257,6 +267,7 @@ jobs:
           check_result clippy         ${{ needs.clippy.result }}
           check_result typos          ${{ needs.typos.result }}
           check_result taplo          ${{ needs.taplo.result }}
+          check_result lockfile       ${{ needs.lockfile.result }}
           check_result machete        ${{ needs.machete.result }}
           check_result msrv           ${{ needs.msrv.result }}
           check_result check-wasm     ${{ needs.check-wasm.result }}

Cargo.toml

@@ -28,7 +28,7 @@ readme = "README.md"
 [workspace.dependencies]
 accesskit = "0.24.0"
 accesskit_macos = "0.26.0"
-accesskit_unix = "0.21.0"
+accesskit_unix = "0.22.0"
 accesskit_windows = "0.32.1"
 anyhow = "1.0.86"
 backtrace = "0.3"

audit.toml

@@ -2,4 +2,9 @@
 ignore = [
   "RUSTSEC-2024-0384", # instant is unmaintained
   "RUSTSEC-2024-0436", # paste is unmaintained
+  "RUSTSEC-2026-0192", # ttf-parser is unmaintained
+
+  # Remove once upstream releases crates that depend on quick-xml >= 0.41.0.
+  "RUSTSEC-2026-0194",
+  "RUSTSEC-2026-0195",
 ]

deny.toml

@@ -7,7 +7,11 @@ no-default-features = false
 feature-depth = 1
 
 [advisories]
-ignore = []
+# RUSTSEC-2026-0194 (quick-xml quadratic attribute check) and RUSTSEC-2026-0195
+# (quick-xml NsReader memory exhaustion) both require quick-xml >= 0.41.0.
+# wayland-scanner 0.31.x and zbus_xml 5.1.x (both at latest) still use ^0.39;
+# no upstream fix is available yet. Remove once those crates release a patch.
+ignore = [{ id = "RUSTSEC-2026-0194" }, { id = "RUSTSEC-2026-0195" }]
 unmaintained = "none"
 unsound = "none"