Diesel 2.3

Apply these rules to Diesel 2.3 applications, Diesel CLI 2.3 schema workflows, Diesel Migrations 2.3, and the PostgreSQL, MySQL/MariaDB, or SQLite backend selected by the application. They were checked against Diesel and Diesel CLI 2.3.13 with Diesel Migrations 2.3.2. Apply the included Rust 1.98 baseline first, including its toolchain and dependency rules.

Version and backend boundary

• Lock Diesel, diesel_derives, and diesel_migrations in Cargo.lock and upgrade them together, because they version separately: the 2.3.13 tag ships diesel_migrations 2.3.2 and diesel_derives 2.3.10. Install diesel_cli with cargo install --locked on the same Diesel release as the application, and check both the application and the separately installed CLI dependency graphs for vulnerable older Diesel copies.
• Treat Rust 1.86.0 as Diesel's minimum compiler; build with the toolchain the Rust baseline's version rule selects, and test every enabled database backend.
• Never roll Diesel or diesel_cli back to a release older than a security fix that an advisory or Diesel's release notes describe.
• Diesel supports only its latest release, so take each new release promptly and read its release notes for security fixes, which can ship before any advisory exists for cargo audit to report; once a successor ships, repeat the release and advisory review instead of staying on the release these rules were checked against.
• Enable only the backend and type-integration features the application uses. Install diesel_cli with --no-default-features and the required backend feature