Trim unused syntax loaders and obsolete advisory exceptions

Use Syntect embedded syntax/theme assets with the existing fancy-regex
backend. Remove unused YAML/plist/HTML loader features and the three
now-unreferenced lock packages. Preserve versions and checksums of every
retained package.

Remove advisory ignores for four crates already absent from the lock and
for yaml-rust removed by this change. Keep only the existing cargo-deny
bincode maintenance exception with current consumer and retirement notes;
cargo-audit ignores are now empty.

Validation: independent five-file source review, TOML parsing, exact lock
graph comparison, and git diff --check passed. Lock pruning is mechanical;
Cargo resolver acceptance, locked compilation, renderer tests and fresh
audit/deny qualification remain UNRUN in the release owner's native lane.
This does not resolve separate Apps/GTK or GLib qualification.

(cherry picked from commit 0e9911378358a44e75e3fc1789417bec635f1c36)

.cargo/audit.toml

@@ -1,21 +1,5 @@
-# cargo-audit configuration (read by `cargo audit`).
-#
-# The advisories below are all "unmaintained" warnings — NOT security
-# vulnerabilities. Each crate is pulled in transitively only by the `starlark`
-# 0.13.0 family (starlark / starlark_syntax / starlark_map), which crates/tui
-# depends on directly for Starlark execpolicy files.
-# `cargo tree -i <crate>` confirms starlark is the sole path for each.
-#
-# There is no fix available without an upstream `starlark` release that drops
-# these deps, and none is exploitable here. They are accepted for now and
-# tracked in this file so `cargo audit` stays clean for genuinely new advisories.
-# Remove an entry once a starlark upgrade/removal drops the transitive dep
-# (re-check with `cargo tree -i derivative` and `cargo audit`).
-#
-# Audit #11, scratchpad/bug-audit-2026-06-24.md.
+# No suppressions: the old Starlark dependencies are absent from Cargo.lock.
+# Keep remaining maintenance warnings visible in cargo-audit. The separately
+# scoped cargo-deny exception is explained in docs/dependency-maintenance.md.
 [advisories]
-ignore = [
-    "RUSTSEC-2024-0388", # derivative 2.2.0 unmaintained — transitive via starlark 0.13.0
-    "RUSTSEC-2025-0057", # fxhash 0.2.1 unmaintained — transitive via starlark_map 0.13.0
-    "RUSTSEC-2024-0436", # paste 1.0.15 unmaintained — transitive via starlark 0.13.0
-]
+ignore = []

Cargo.lock

@@ -3829,19 +3829,6 @@ version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
 
-[[package]]
-name = "plist"
-version = "1.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7da1d65da6dd5d1e44199ac0f58712d241c0f439f80adea8924d832384087f85"
-dependencies = [
- "base64 0.22.1",
- "indexmap",
- "quick-xml",
- "serde",
- "time",
-]
-
 [[package]]
 name = "png"
 version = "0.18.1"
@@ -3982,15 +3969,6 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
 
-[[package]]
-name = "quick-xml"
-version = "0.41.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "quinn"
 version = "0.11.11"
@@ -5358,14 +5336,11 @@ dependencies = [
  "flate2",
  "fnv",
  "once_cell",
- "plist",
  "regex-syntax",
  "serde",
  "serde_derive",
- "serde_json",
  "thiserror 2.0.20",
  "walkdir",
- "yaml-rust",
 ]
 
 [[package]]
@@ -6890,15 +6865,6 @@ dependencies = [
  "markup5ever",
 ]
 
-[[package]]
-name = "yaml-rust"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56c1936c4cc7a1c9ab21a1ebb602eb942ba868cbd44a99cb7cdc5892335e1c85"
-dependencies = [
- "linked-hash-map",
-]
-
 [[package]]
 name = "yansi"
 version = "1.0.1"

crates/tui/Cargo.toml

@@ -75,7 +75,8 @@ rustls.workspace = true
 qrcode = { version = "0.14", default-features = false }
 similar = { version = "3", features = ["unicode"] }
 ansi-to-tui = { version = "8.0.1", default-features = false }
-syntect = { version = "5.2", default-features = false, features = ["default-fancy"] }
+# The renderer uses embedded syntax/theme dumps, not external YAML/plist loaders.
+syntect = { version = "5.2", default-features = false, features = ["default-syntaxes", "default-themes", "regex-fancy"] }
 serde.workspace = true
 serde_json = { workspace = true, features = ["preserve_order", "raw_value"] }
 schemars = { version = "1.2.1", features = ["derive", "preserve_order"] }

deny.toml

@@ -9,14 +9,10 @@ all-features = true
 # Deny unmaintained and unsound crates
 unmaintained = "all"
 unsound = "all"
-# Ignore specific advisories (known issues in dependencies)
+# Scoped maintenance exception; consumer and retirement criteria are documented
+# in docs/dependency-maintenance.md. No vulnerability/unsoundness ignore is added.
 ignore = [
-    "RUSTSEC-2024-0436",  # paste unmaintained - no safe upgrade
-    "RUSTSEC-2026-0192",  # ttf-parser unmaintained - no safe upgrade
-    "RUSTSEC-2024-0388",  # derivative unmaintained - transitive via starlark
-    "RUSTSEC-2025-0057",  # fxhash unmaintained - transitive via starlark
-    "RUSTSEC-2025-0141",  # bincode unmaintained - transitive via syntect, no safe upgrade (syntect 5.3.0 is latest)
-    "RUSTSEC-2024-0320",  # yaml-rust unmaintained - transitive via syntect, no safe upgrade (syntect 5.3.0 is latest)
+    "RUSTSEC-2025-0141",  # bincode 1.3.3: syntect's embedded syntax/theme dumps
 ]
 
 [bans]

docs/dependency-maintenance.md

@@ -0,0 +1,32 @@
+# Dependency maintenance
+
+Reviewed against the 0.9.13 Core dependency graph on September 8, 2026.
+This records maintenance decisions, not a security clearance or release test.
+
+The terminal Markdown renderer uses Syntect's embedded syntax and theme dumps
+with the existing fancy-regex backend. It does not load external syntax YAML,
+theme plists, or emit Syntect HTML. Selecting those features explicitly removes
+the unused `yaml-rust`, `plist`, and `quick-xml` dependency path. The embedded
+YAML language grammar remains available for highlighting YAML code blocks.
+
+`derivative`, `fxhash`, `paste`, and `ttf-parser` are absent from the Core lockfile.
+Their obsolete advisory exceptions are removed so a future reintroduction is
+visible to the advisory checks. No `cargo-audit` advisory is ignored.
+
+The remaining `cargo-deny` maintenance exception is
+[RUSTSEC-2025-0141](https://rustsec.org/advisories/RUSTSEC-2025-0141.html)
+for `bincode` 1.3.3. Syntect 5.3.0 requires it to deserialize its compiled-in
+syntax and theme assets and for its parser's internal lazy-context encoding.
+Codewhale does not pass arbitrary external dump files to these loaders. The
+maintenance warning remains visible in `cargo-audit`; the lack of an identified
+exploit in this advisory does not guarantee safety.
+
+Revisit the exception when upgrading or replacing Syntect, or before adding
+external dump, grammar, or theme loading. Remove it when the dependency leaves
+the graph. A replacement must preserve embedded language/theme coverage,
+multiline highlighting and error recovery, and pass the existing Markdown
+renderer tests with a resolver-verified lockfile. Adding ignores for new
+advisories requires a separate assessment.
+
+The Apps desktop lockfile and its platform dependencies are a separate graph;
+this Core cleanup does not resolve their maintenance or GLib qualification work.