crates/glyphnet-wasm/Cargo.toml (1)

29-29: ⚡ Quick win

Update on instant dependency (version + security)

• instant pinned to 0.1.13 is the latest crates.io release.
• No known RustSec security advisories are reported for instant 0.1.13.
• instant is marked unmaintained (RustSec RUSTSEC-2024-0384) and recommends migrating to web-time; consider whether you want to take that maintenance risk and/or add cargo-audit to catch future advisories.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/glyphnet-wasm/Cargo.toml` at line 29, The Cargo.toml currently pins
the unmaintained dependency "instant" (instant = { version = "0.1.13", features
= ["wasm-bindgen"] }) which is flagged by RUSTSEC-2024-0384; either migrate to
the recommended maintained crate "web-time" (replace the Cargo.toml entry,
update feature flags as needed, and update all code references from
instant::Instant (or instant::now()) to web_time::Instant / web_time::now()) or
explicitly document/accept the maintenance risk and add cargo-audit as a
dev-dependency to detect future advisories (add cargo-audit to
[dev-dependencies] and CI). Ensure you update import paths and any API
differences in functions/classes that used instant so builds and tests pass.

apps/expo-glyphnet/scripts/build-glyphnet-jni-android.sh (1)

14-16: 💤 Low value

Consider consistent error handling for missing build tools.

The script exits gracefully (exit 0 with WARNING) when cargo or cargo-ndk is missing, but will fail hard if rustup target add fails. This inconsistency may surprise developers who expect the same graceful degradation behavior.

If the intent is to skip JNI builds when any build tool is unavailable or misconfigured, consider wrapping the rustup command with similar error handling. If the intent is to fail when tools are present but misconfigured, the current behavior is correct.

🔄 Optional: Add consistent error handling

 echo "Ensuring Rust Android targets are installed..."
-rustup target add aarch64-linux-android armv7-linux-androideabi x86_64-linux-android
+if ! rustup target add aarch64-linux-android armv7-linux-androideabi x86_64-linux-android; then
+  echo "WARNING: Failed to install Rust Android targets. Skipping GlyphNet JNI build."
+  exit 0
+fi

Note: Only apply this if graceful degradation for all missing tools is the intended behavior.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/expo-glyphnet/scripts/build-glyphnet-jni-android.sh` around lines 14 -
16, The rustup target installation step (rustup target add aarch64-linux-android
armv7-linux-androideabi x86_64-linux-android) currently fails hard while earlier
checks for cargo/cargo-ndk exit gracefully; update the script so the rustup
command's failure is handled consistently — run rustup target add, capture its
exit status, and if it fails echo a WARNING describing the failure (include
stderr) and exit 0 to skip JNI builds (or exit nonzero if you prefer hard
failure), mirroring the existing cargo/cargo-ndk error handling pattern.