fix(supply-chain): exempt 8 unvetted crates for cargo vet

[snowmead]

Summary

• cargo vet was failing on 8 unvetted deps (arbitrary, crossbeam-utils, derive_arbitrary, mime_guess, unicase, urlencoding, zip, zopfli) from gitlab/netlify/reqwest.
• Regenerated minimal safe-to-deploy exemptions in supply-chain/config.toml (matches existing supply-chain practice).

Test plan

• mise exec -- cargo vet succeeds locally
• CI supply-chain / vet job passes

---

Note

Low Risk
Config-only supply-chain exemptions; no application, auth, or deployment behavior changes.

Overview
Adds eight new [[exemptions.*]] entries in supply-chain/config.toml, each pinned to a specific version and marked safe-to-deploy, so cargo vet can pass for transitive deps that appeared via GitLab, Netlify, and reqwest-related work.

The newly exempted crates are arbitrary / derive_arbitrary (1.4.2), crossbeam-utils (0.8.22), mime_guess (2.0.5) with unicase (2.9.0), urlencoding (2.1.3), and zip (2.4.2) with zopfli (0.8.3). No runtime or application logic changes—only supply-chain policy metadata, consistent with existing exemption style in the same file.

^{Reviewed by Cursor Bugbot for commit a7bddca. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
stackless	Ready	Preview	Jul 31, 2026 8:57pm

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_911f368f-a136-46c6-9856-4284856896a4)

[cursor]

Thermos review

Verdict: no medium+ findings (security/correctness + code-quality passes).

Config-only change: eight version-pinned safe-to-deploy exemptions in supply-chain/config.toml for crates required by cargo vet after gitlab/netlify/reqwest-related deps. Pins match Cargo.lock; entries are alphabetically placed; local cargo vet succeeds. No RustSec hits on the exempted crates. zip is already feature-minimized (default-features = false, deflate only) and used write-only for Netlify upload.

No prior automation threads to reconcile. Bugbot did not run (usage limit).

  

_{Sent by Cursor Automation: Find vulnerabilities}