{"agent":"claude","input":"Audit this Rust workspace's dependencies and fix the advisories. Read Cargo.toml, Cargo.lock, rust-toolchain files if any, .github/workflows/main.yml, ci/update-dependencies.sh and CONTRIBUTING.md first. Run cargo audit --json and save the output. For each advisory use cargo tree -i to find the path from a workspace crate, then apply the smallest fix: cargo update -p for a patched version inside the current requirement, a bump in [workspace.dependencies] when a new minor or major is needed, the parent crate when the vulnerable crate is transitive, and never a bump of a dependency the manifest marks as part of the public API. Add an ignore in .cargo/audit.toml only when no fix exists, with the advisory id and the reason. Run cargo test --workspace --locked, the no-default-features build, cargo clippy --workspace --all-targets --no-deps -- -D warnings, cargo doc with RUSTDOCFLAGS=-D warnings, cargo fmt --check, a build on the rust-version toolchain, and cargo semver-checks --workspace, then cargo audit again. Open a pull request with the audit output before and after, one line per upgrade with its advisory, every advisory left open with the reason, and the test summary. Change no source file unless a bumped crate's API forces it, and explain any such change.","resources":[{"url":"https://github.com/your-org/your-app"}]}