chore(deps): upgrade tabled to 0.22 and retire RUSTSEC-2026-0173

crates/bashkit-bench/Cargo.toml

@@ -25,4 +25,4 @@ tempfile.workspace = true
 
 # Terminal output
 colored = "3"
-tabled = "0.21"
+tabled = "0.22"

deny.toml

@@ -50,10 +50,6 @@ ignore = [
     # atomic-polyfill: transitive via monty -> postcard -> heapless
     # Unmaintained but no security vulnerability; upstream dep we can't control
     "RUSTSEC-2023-0089",
-    # proc-macro-error2: transitive via bashkit-bench -> tabled -> tabled_derive
-    # Unmaintained build-time proc-macro in the bench harness only (not shipped
-    # library code); no upgrade available (tabled 0.21 is latest)
-    "RUSTSEC-2026-0173",
 ]
 
 [bans]

knowledge/security/threat-model.md

@@ -1574,8 +1574,7 @@ the two lists in sync so a local `cargo deny check advisories` matches CI.
 | Advisory | Crate | Why suppressed | Remove when |
 |----------|-------|----------------|-------------|
 | RUSTSEC-2023-0071 | `rsa` | Marvin timing sidechannel (TM-CRY-002). No patched version exists; reachable only via the opt-in `ssh` feature | `rsa` ships a constant-time release |
-| RUSTSEC-2023-0089 | `atomic-polyfill` | Unmaintained, no known vulnerability; transitive via `monty` → `postcard` → `heapless` | Upstream drops the dependency |
-| RUSTSEC-2026-0173 | `proc-macro-error2` | Unmaintained build-time proc-macro, bench harness only (not shipped library code); transitive via `tabled` | `tabled` releases a version without it |
+| RUSTSEC-2023-0089 | `atomic-polyfill` | Unmaintained, no known vulnerability; transitive via `monty` → `postcard` → `heapless` (pinned at 0.7, which still requires it) | Upstream drops the dependency |
 
 A suppression that stops matching is not evidence that it can be dropped.
 `cargo deny check advisories` currently warns `advisory-not-detected` for
@@ -1586,6 +1585,13 @@ matching resumes as soon as `rsa` ships a stable release. Before removing any
 entry above, check the advisory's own `patched` list rather than the scanner's
 silence.
 
+Retired: RUSTSEC-2026-0173 (`proc-macro-error2`, unmaintained). Its recorded
+removal condition — "`tabled` releases a version without it" — was met by
+`tabled` 0.22 / `tabled_derive` 0.12, which drops the dependency. The bench
+harness was moved to 0.22 and the crate is gone from `Cargo.lock`, so the
+suppression was deleted rather than left to rot. This is the shape a removal
+should take: the dependency is actually gone, not merely unmatched.
+
 ### Fuzzing Targets
 
 The following components are fuzz-tested for robustness:

supply-chain/config.toml

@@ -1937,11 +1937,11 @@ version = "1.0.2"
 criteria = "safe-to-deploy"
 
 [[exemptions.tabled]]
-version = "0.21.0"
+version = "0.22.0"
 criteria = "safe-to-deploy"
 
 [[exemptions.tabled_derive]]
-version = "0.11.0"
+version = "0.12.0"
 criteria = "safe-to-deploy"
 
 [[exemptions.tap]]