---
id: SMH-ISSUE-5E1DUMSN
type: issue
title: "Audit succeeds with unresolved dependency and license warnings"
specs: [SMH-SPEC-SPEC0001]
---

# Audit succeeds with unresolved dependency and license warnings

## Symptom

`cargo x audit` exits 0 despite unresolved duplicate-family warnings.
A successful command does not establish the specification's warning-free quality gates.

## Evidence

Original assessment: nine duplicate families plus one unmatched license allowance.
Removed obsolete Unicode-DFS-2016 allowance.
Aligned guest wit-bindgen 0.61.1 with Wasmtime 49.0.1; five duplicate Wasm-tooling families disappeared.
Recorded coordinated release management in workspace comments and `.system/RULES.md`.

Earlier audit: `target/deps-closeout/exact-pin-audit.log`, exit 0, four warnings, no advisory failures.
Remaining incompatible upstream lines:

- getrandom: ring, proptest, and uuid require different release lines.
- hashbrown: Wasmtime's Cranelift and gimli paths require different release lines; ratatui also contributes.
- syn: macro dependencies require both major versions.
- windows-sys: ring requires 0.52; modern platform dependencies require 0.61.

Dependency paths: `target/deps-exec/reverse-workspace-all-*.log`.
No compatible release set resolving these four families has been verified.
No skip-lists, warning suppression, engine replacement, or portability reduction applied.

Verification: 366 checks/tests, 29 E2E tests, real guest build and host invocation pass.
Pinned-platform perf: 14/14, existing budgets unchanged.
Logs: `target/deps-closeout/exact-pin-verification.log`, `target/deps-closeout/exact-pin-perf.log`.
Container audit refresh in the combined log failed fetching GitHub; the subsequent host audit above completed.
Verification also exposed and corrected canonical fixture-path variability and observer refresh loss when export superseded navigation.
Logs are local evidence, not committed fixtures.

## Dependency execution update

Fresh `cargo x audit` after Wasmtime 49.0.2 and guest wit-bindgen 0.62.0 passes advisory, yank, license, and source checks.
Runtime-only duplicate reporting still names getrandom 0.2.17/0.4.3, hashbrown 0.16.1/0.17.1, and windows-sys 0.52.0/0.61.2.
Macro/build/dev duplicate families are outside that runtime report, not resolved by these upgrades.

- getrandom 0.2.17 remains through ring 0.17.14 and rustls; Smith uses 0.4.3.
- hashbrown 0.16.1 remains through gimli and kasuari; current Wasmtime and ratatui paths also contain 0.17.1.
- windows-sys 0.52.0 remains through ring, errno, rustix, and winapi-util; modern platform paths also contain 0.61.2.

Fresh direct-dependency report finds no newer selectable stable direct release.
All eight host-target runtime library consumer checks pass for locked, fresh-compatible, and direct-minimum resolution.
Successful audit exit still does not establish warning-free acceptance.
No duplicate skip-list or warning suppression applied; issue remains open.
Local reverse-edge and audit evidence: `/tmp/smith-dependency-exec-YD78WF/duplicates-*.log` and `audit-current.log`.

## Impact

Dependency hygiene remains unresolved while audit appears green.
No security advisory failure was reported by this run.

## Reproduction

Run `cargo x audit` against the assessed dependency graph; inspect warnings separately from exit status.
Resolve obsolete allowance and compatible dependency upgrades without duplicate skip-lists or warning suppression.
Re-run audit and distinguish command success from warning-free acceptance.

## Contract

[Smith Specification](../../specs/SMH-SPEC-SPEC0001-smith-specification/index.md): required quality gates pass without warnings.