deps-update

To safely update Rust Cargo dependencies and fix vulnerabilities, run cargo audit to detect CVEs, apply semver-compatible updates via cargo update, then verify build integrity using cargo check, clippy, and tests before staging lockfiles for commit.

Responding to Dependabot alerts involves running baseline audits for Rust and bun-managed frontend packages, applying safe semver updates or explicit version bumps for CVE remediation, and verifying typechecks and builds before committing dependency files.

Yes, you can audit and update both Rust backend and bun-managed frontend dependencies in one workflow by executing cargo audit and bun audits sequentially, applying semver updates, and verifying outcomes with cargo check, clippy, tests, and frontend typechecks.

Cargo audit identifies transitive vulnerabilities that remain after applying semver-compatible updates. When routine updates cannot remediate a CVE, an explicit upgrade mode allows researched version bumps to target and resolve the specific vulnerability.

To upgrade Cargo package versions beyond semver for patching a specific security vulnerability, use an explicit upgrade mode for researched version bumps, then verify the remediation succeeds by running cargo audit, cargo check, clippy, and tests.

Staging only dependency files like Cargo.lock when updating project dependencies isolates version changes from unrelated source modifications, ensuring the commit cleanly represents the semver updates and vulnerability patches verified during the build and test process.