fix(security): clear cargo-audit vulnerabilities + unmaintained-fxhash denial (resolves #113) (#126)

## What

Resolves #113 — `cargo audit` is red on `main` (the scheduled workflow
auto-opened the issue on 2026-08-31). Reproduced locally, fixed at
source, and every affected gate verified green with CI's exact
invocations.

## Audit findings → fixes

| Finding | Fix |
|---|---|
| `wasmtime` 36.0.11 — **RUSTSEC-2026-0269** (fs sandbox escape via
trailing slashes, **high**) & RUSTSEC-2026-0222 | bump to **36.0.15** (≥
36.0.14 patched, 36.x line) |
| `crossbeam-epoch` 0.9.18 — RUSTSEC-2026-0204 | bump to **0.9.21** (≥
0.9.20 patched) |
| `anyhow` 1.0.102 — RUSTSEC-2026-0190 (unsound `downcast_mut`) | bump
to **1.0.104** (≥ 1.0.103 patched) |
| `fxhash` — RUSTSEC-2025-0057 (unmaintained, **`patched = []`** — no
bump can fix) | **removed at source**: it only entered via wasmtime's
default `profiling` feature → `fxprof-processed-profile`. The plugin
sandbox uses core runtime + fuel metering only, so the manifest sets
`default-features = false` with `cranelift`/`runtime`/`std`/`wat`. Graph
shrinks 335 → 301 crates. |

Both `cargo audit --deny warnings` and `cargo audit --deny unmaintained`
exit 0 against the updated, committed `Cargo.lock`.

## Pre-existing gate breakage also repaired (main was already red)

Reproducing CI locally showed these failures independent of the audit:

- **`cargo check --all-targets` failed** — `benches/rpa_benchmarks.rs`
was added without the root `[dev-dependencies]` it imports (`criterion`,
`rpa-core`, `rpa-plugin`, `serde_json`); plus a stale
`record_error("…")` arg vs `WorkflowState::record_error()`.
- **`cargo fmt --all -- --check` failed on 9 files** → canonicalised.
- **`rpa-scheduler` tests didn't compile** — chrono removed
`LocalResult::expect`; migrated to `.single().expect(...)` (5 sites).

## Verification (toolchain rustc/cargo 1.98.1 stable, cargo-audit
0.22.2, fresh advisory DB)

```
cargo audit --deny warnings                          PASS
cargo audit --deny unmaintained                      PASS
cargo check  --locked --all-targets                  PASS
cargo fmt    --all -- --check                        PASS
cargo clippy --locked --all-targets -- -D warnings   PASS
cargo test   --locked --all-targets                  PASS
cargo test   --locked --workspace --all-targets      PASS  (128 tests, 0 failures)
```

Resolves #113.

Author: hyperpolymath

Cargo.lock

@@ -26,6 +26,15 @@ description = "RPA Elysium - Comprehensive test suite for filesystem automation"
 name = "rpa_benchmarks"
 harness = false
 
+# Dev-dependencies for the root bench target (benches/rpa_benchmarks.rs).
+# Without these the CI `cargo check --all-targets` gate fails to compile
+# the bench (unresolved criterion / rpa_core / rpa_plugin / serde_json).
+[dev-dependencies]
+criterion = { workspace = true }
+rpa-core = { path = "crates/rpa-core" }
+rpa-plugin = { path = "crates/rpa-plugin" }
+serde_json = { workspace = true }
+
 [workspace.package]
 version = "0.1.0"
 edition = "2021"
@@ -66,7 +75,17 @@ zip = "0.6"
 chrono = { version = "0.4", features = ["serde"] }
 
 # Plugin system (WASM sandbox)
-wasmtime = "36.0.8"
+# `profiling` (a wasmtime default feature) is deliberately disabled: it is the
+# only path pulling `fxprof-processed-profile` -> `fxhash`, which is
+# unmaintained (RUSTSEC-2025-0057) and fails `cargo audit --deny unmaintained`.
+# The plugin sandbox uses core-Wasm runtime + fuel metering only, so the
+# guest-profiler machinery is dead weight here.
+wasmtime = { version = "36.0.8", default-features = false, features = [
+    "cranelift",
+    "runtime",
+    "std",
+    "wat",
+] }
 wit-bindgen = "0.36"
 uuid = { version = "1.6", features = ["v4", "serde"] }
 

Cargo.toml

@@ -81,7 +81,7 @@ fn bench_workflow_state(c: &mut Criterion) {
         let mut state = WorkflowState::new("test");
         state.start();
         b.iter(|| {
-            state.record_error(black_box("error"));
+            state.record_error();
         });
     });
 
@@ -93,21 +93,15 @@ fn bench_permission_checking(c: &mut Criterion) {
     let mut group = c.benchmark_group("permissions");
 
     group.bench_function("permission_check_read_path", |b| {
-        let set = PermissionSet::empty()
-            .with(Permission::read_path("/tmp/data"));
+        let set = PermissionSet::empty().with(Permission::read_path("/tmp/data"));
 
-        b.iter(|| {
-            set.check(black_box(&Permission::read_path("/tmp/data/file.txt")))
-        });
+        b.iter(|| set.check(black_box(&Permission::read_path("/tmp/data/file.txt"))));
     });
 
     group.bench_function("permission_check_denied", |b| {
-        let set = PermissionSet::empty()
-            .with(Permission::read_path("/tmp/data"));
+        let set = PermissionSet::empty().with(Permission::read_path("/tmp/data"));
 
-        b.iter(|| {
-            set.check(black_box(&Permission::write_path("/tmp/data")))
-        });
+        b.iter(|| set.check(black_box(&Permission::write_path("/tmp/data"))));
     });
 
     group.bench_function("permission_set_creation_small", |b| {
@@ -137,9 +131,7 @@ fn bench_permission_checking(c: &mut Criterion) {
             Permission::Random,
         ]);
 
-        b.iter(|| {
-            set.check(black_box(&Permission::read_path("/tmp/file.txt")))
-        });
+        b.iter(|| set.check(black_box(&Permission::read_path("/tmp/file.txt"))));
     });
 
     group.finish();

benches/rpa_benchmarks.rs

@@ -143,10 +143,7 @@ fn test_concurrent_workflow_state_error_recording() {
 
     // Verify final count
     let state = state.lock().unwrap();
-    assert_eq!(
-        state.error_count, 1000,
-        "should have recorded 1000 errors"
-    );
+    assert_eq!(state.error_count, 1000, "should have recorded 1000 errors");
 }
 
 /// Test concurrent mixed operations on WorkflowState
@@ -210,7 +207,10 @@ fn test_high_concurrency_event_creation() {
                 );
 
                 // Verify event invariants immediately
-                assert!(event.id.starts_with("evt_"), "event ID should start with evt_");
+                assert!(
+                    event.id.starts_with("evt_"),
+                    "event ID should start with evt_"
+                );
                 assert_eq!(event.source, format!("/test/{}/{}", thread_id, i));
 
                 events.lock().unwrap().push(event);

crates/rpa-core/tests/concurrency_tests.rs

@@ -28,10 +28,7 @@ fn arb_event_kind() -> impl Strategy<Value = EventKind> {
             .prop_map(|s| PathBuf::from(format!("/tmp/{}", s)))
             .prop_map(|p| EventKind::FileDeleted { path: p }),
         // FileRenamed events
-        (
-            "[a-z]+\\.rs",
-            "[a-z]+\\.rs",
-        )
+        ("[a-z]+\\.rs", "[a-z]+\\.rs",)
             .prop_map(|(f1, f2)| {
                 (
                     PathBuf::from(format!("/tmp/{}", f1)),
@@ -40,8 +37,7 @@ fn arb_event_kind() -> impl Strategy<Value = EventKind> {
             })
             .prop_map(|(from, to)| EventKind::FileRenamed { from, to }),
         // Scheduled events - just simple time strings
-        Just("10:30".to_string())
-            .prop_map(|s| EventKind::Scheduled { schedule: s }),
+        Just("10:30".to_string()).prop_map(|s| EventKind::Scheduled { schedule: s }),
     ]
 }
 

crates/rpa-core/tests/property_tests.rs

@@ -24,12 +24,18 @@ fn test_e2e_file_creation_and_rename_workflow() {
     fs::rename(&test_file, &renamed_file).expect("rename file");
 
     // Verify old file is gone
-    assert!(!test_file.exists(), "old file should not exist after rename");
+    assert!(
+        !test_file.exists(),
+        "old file should not exist after rename"
+    );
     assert!(renamed_file.exists(), "renamed file should exist");
 
     // Verify content is preserved
     let content = fs::read_to_string(&renamed_file).expect("read renamed file");
-    assert_eq!(content, "test content", "content should be preserved after rename");
+    assert_eq!(
+        content, "test content",
+        "content should be preserved after rename"
+    );
 }
 
 /// Test complete file copy workflow
@@ -47,7 +53,10 @@ fn test_e2e_file_copy_workflow() {
 
     // Verify both files exist
     assert!(source_file.exists(), "source file should still exist");
-    assert!(dest_file.exists(), "destination file should exist after copy");
+    assert!(
+        dest_file.exists(),
+        "destination file should exist after copy"
+    );
 
     // Verify content matches
     let source_content = fs::read_to_string(&source_file).expect("read source");
@@ -79,7 +88,10 @@ fn test_e2e_file_move_workflow() {
     // Verify file is in archive with content intact
     assert!(archived_file.exists(), "archived file should exist");
     let archived_content = fs::read_to_string(&archived_file).expect("read archived file");
-    assert_eq!(archived_content, content, "content should be preserved in archive");
+    assert_eq!(
+        archived_content, content,
+        "content should be preserved in archive"
+    );
 }
 
 /// Test complete file deletion workflow
@@ -149,7 +161,10 @@ fn test_e2e_workflow_with_file_operations_on_large_file() {
 
     // Verify copy integrity
     let copy_content = fs::read(&copy).expect("read copy");
-    assert_eq!(copy_content, large_content, "large file copy should be identical");
+    assert_eq!(
+        copy_content, large_content,
+        "large file copy should be identical"
+    );
 
     // Clean up original
     fs::remove_file(&large_file).expect("delete original");
@@ -301,7 +316,11 @@ fn test_e2e_workflow_with_empty_files() {
     assert!(!empty_file.exists());
     assert!(renamed.exists());
     let renamed_metadata = fs::metadata(&renamed).expect("get renamed metadata");
-    assert_eq!(renamed_metadata.len(), 0, "renamed file should still be empty");
+    assert_eq!(
+        renamed_metadata.len(),
+        0,
+        "renamed file should still be empty"
+    );
 }
 
 /// Test workflow cleanup

crates/rpa-fs-workflow/tests/e2e_workflow_tests.rs

@@ -270,7 +270,10 @@ fn test_concurrent_file_access_handling() {
 
     // File should still be readable at the end
     let result = fs::read_to_string(&file);
-    assert!(result.is_ok(), "should be able to read file after concurrent access");
+    assert!(
+        result.is_ok(),
+        "should be able to read file after concurrent access"
+    );
 }
 
 /// Test handling of metadata access on missing file
@@ -280,7 +283,10 @@ fn test_metadata_missing_file_handling() {
     let missing = temp.path().join("missing.txt");
 
     let result = fs::metadata(&missing);
-    assert!(result.is_err(), "should fail to get metadata of missing file");
+    assert!(
+        result.is_err(),
+        "should fail to get metadata of missing file"
+    );
 }
 
 /// Test handling of operations on empty directory