[murillo-consulting]

What changed

• update transitive event-listener from 5.4.1 to 5.4.2 in Cargo.lock
• remove the no-longer-needed concurrent-queue edge from that lock entry

Root cause

event-listener 5.4.1 is affected by RUSTSEC-2026-0221: StackSlot implemented Send and Sync without requiring the tag type to be Send, allowing a !Send tag to cross thread boundaries.

Impact

This applies the upstream soundness fix without changing Gate's public API or direct dependency ranges. The vulnerable package is transitive through moka / async-lock.

Validation

• cargo update -p event-listener --precise 5.4.2 completed
• cargo tree -i event-listener@5.4.1 confirmed the affected dependency chain before the update
• git diff --check passed
• full local tests could not complete on Windows because the existing aws-lc-sys build requires unavailable native tooling (NASM/CMake)
• repository CI passed all 27 checks, including Clippy, tests, feature powersets, CodeQL, coverage, and Gitleaks

Rollback

Revert commit 4250c9e to restore the previous lockfile.

Closes #1

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.