[alangou]

Summary

Update pulldown-cmark to 0.13.6 to restore Cargo Deny qualification for prereleases. The v0.1.7-pre.4 run failed on RUSTSEC-2026-0433 because the Protobuf build dependency prost-build still resolved pulldown-cmark 0.13.5.

Related Issue

No separate issue: this fixes a broken CI check under the maintainer build-fix exception in CONTRIBUTING.md.

Failing prerelease Cargo Deny job.

Changes

• Upgrade pulldown-cmark from 0.13.5 to 0.13.6, the patched release for RUSTSEC-2026-0433.
• Apply the targeted update to all eight affected lockfiles, including the standalone examples and test workspaces.

Release Notes

Testing

• mise run rust:deny — advisory, license, ban, source, and crypto dependency policy checks pass.
• mise run rust:lockfiles:check — all 12 tracked lockfiles and workspace alignment checks pass.
• mise exec -- cargo test --locked -p openshell-core --lib — 598 tests pass.
• CI E2E tests (test:e2e; pending).

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Architecture docs updated (not applicable to this lockfile-only fix).

[github-actions]

Label test:e2e applied, but pull-request/5122 does not exist yet. A maintainer needs to comment /ok to test a2b3544e1c3d1f236e9e85ff1f0e42d5ef4b7f5f to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[alangou]

/ok to test a2b3544