Rust Dep Hygiene

Dependency hygiene for the Rocky engine

Workspace-dep rule

All dependencies go through [workspace.dependencies] in engine/Cargo.toml. Individual crates under engine/crates/* inherit versions by referencing the workspace:

# In crates/rocky-fivetran/Cargo.toml
[dependencies]
reqwest  = { workspace = true }
tokio    = { workspace = true }
thiserror = { workspace = true }

Never do this in a leaf crate:

# DON'T — bypasses the workspace pin
[dependencies]
reqwest = "0.12"

Why: the workspace has dozens of crates. Per-crate version pins drift, cause duplicate dep compilations, and break the MSRV contract.

Adding a new workspace dependency

1. Edit engine/Cargo.toml and add the dep to [workspace.dependencies] with the exact version and feature set you need.
2. In the specific crate that needs it, add <dep> = { workspace = true } (plus a features = [...] override if the crate needs a narrower subset — it's allowed to turn features on, never off).
3. Run cargo build -p <crate> to confirm resolution.
4. Run cargo tree -d to check you haven't introduced a duplicate version of anything (see "Duplicates" below).
5. Never cargo add inside a sub-crate without the --workspace or without editing [workspace.dependencies] first.

Upgrading a workspace dependency

# From engine/
cargo update -p <crate_name>            # Minor/patch only — respects the Cargo.toml version req.
cargo update                            # Everything — use with care, always review Cargo.lock diff.

Major version bumps require editing engine/Cargo.toml directly and checking the changelog for breaking changes. Pin the version in [workspace.dependencies], not in individual crates.

MSRV (1.88, Rust 2024 edition)

engine/Cargo.toml declares:

[workspace.package]
edition = "2024"
rust-version = "1.88"

Bumped 1.85.1 → 1.88 on 2026-05-24: the rocky-mcp crate's rmcp tree (rmcp-macros → darling 0.23, edition 2024) requires rustc 1.88, so the effective workspace MSRV was already 1.88. (The tree was rmcp 1.7 at the bump; it is rmcp 2.2 now — still darling 0.23 / edition 2024, so the 1.88 floor is unchanged.)

Rules:

1. Don't use features newer than 1.88 in any engine crate. If a stable feature lands in 1.89+, either wait for the next MSRV bump or gate your usage behind something that compiles on 1.88.
2. Dependencies can have their own MSRV. If a dep requires Rust 1.90 and Rocky is on 1.88, you have two choices: pin an older version of the dep (check cargo tree and the dep's changelog) or propose an MSRV bump.
3. Bumping MSRV is a policy change. Don't do it unilaterally. Propose to Hugo, note the reason (typically: a dep dropped support for the old MSRV), and bump both the [workspace.package] line and the CI toolchain installer in .github/workflows/engine-ci.yml in the same PR.
4. Edition bumps (2024 → 2027 when that exists) are separate from MSRV bumps and even rarer. Don't conflate them.

Security audit: cargo audit

Rocky runs cargo audit weekly, not on every PR. From .github/workflows/engine-weekly.yml:

schedule:
  - cron: '0 8 * * 1'   # Monday 08:00 UTC

- name: Run cargo audit
  run: cargo audit

The workflow is also manually dispatchable (workflow_dispatch) and marked continue-on-error: true, so advisories don't block PRs — they surface as a Monday morning report.

To run it locally:

cargo install cargo-audit     # first time only
cd engine
cargo audit

When to react:

• critical or high — fix this week. Either bump the transitive dep (via cargo update -p or a workspace bump) or vendor a patch.
• medium — schedule a fix in the current iteration.
• low / informational — note, don't drop everything.
• unsound advisories on a library dep are different from vulnerabilities — they indicate soundness bugs in the dep, and the right fix is usually a version bump or a report upstream, not a workspace allowlist.

cargo audit does not currently have an allow-list for accepted advisories in Rocky. If you want to ignore a specific advisory with a reason, that's a policy change — propose it to Hugo first. (The mechanism is audit.toml with ignore = ["RUSTSEC-YYYY-NNNN"] and a reason = "..." line.)