Bump cargo-vet to 0.10.2

[felipebalbi]

No description provided.

[Copilot]

Pull request overview

Updates the GitHub Actions workflow that runs cargo vet so CI installs and uses the newer cargo-vet release, keeping the dependency vetting tooling current.

Changes:

• Bump CARGO_VET_VERSION in the cargo-vet workflow from 0.10.1 to 0.10.2.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Cargo Vet Audit Passed

cargo vet has passed in this PR. No new unvetted dependencies were found.

[felipebalbi]

This PR only changes CARGO_VET_VERSION from 0.10.1 to 0.10.2 and reformats supply-chain/imports.lock to match the new serializer (see below).

ubuntu / stable / deny is pre-existing and unrelated

The failure is RUSTSEC-2026-0173, a newly published advisory marking proc-macro-error2 unmaintained. cargo-deny reads only deny.toml and Cargo.lock, neither of which this PR touches. Reproduced locally on this branch with the exact CI invocation:

$ cargo deny --all-features --locked check advisories
error[unmaintained]: proc-macro-error2 is unmaintained
  ID: RUSTSEC-2026-0173
  proc-macro-error2 v2.0.1
  └── defmt-macros v1.0.1
      └── defmt v1.0.1
advisories FAILED

There is no safe upgrade available. The fix is either an ignore entry in deny.toml or waiting for defmt-macros to migrate off it. Note deny.toml already ignores the predecessor advisory RUSTSEC-2024-0370 for the same crate lineage, so extending it would be consistent — happy to add that here if you'd prefer this PR go fully green.

---

Why imports.lock changed

cargo-vet 0.10.2 bumped toml_edit 0.14.4 -> 0.22.26 and toml 0.5.9 -> 0.8.22. The new serializer emits strings differently (unescaped " inside """ blocks), so a store written by 0.10.1 now fails 0.10.2's consistency check. The commit here is the output of cargo vet fmt and is quoting-only — no audit content changed. Verified locally: cargo vet --locked exits 0.

[felipebalbi]

Update: fixed in this PR. The comment above offered to add the ignore entry; it has now been added and CI is green.

RUSTSEC-2026-0173 (proc-macro-error2 is unmaintained) is now in the deny.toml ignore list, alongside the existing RUSTSEC-2024-0370 entry for the same crate lineage. There is still no safe upgrade available — proc-macro-error2 comes in transitively via defmt-macros -> defmt, so this remains an upstream migration issue.

Verified locally with the exact CI invocation:

$ cargo deny --all-features --locked check
advisories ok, bans ok, licenses ok, sources ok