Cargo.toml dependencies need cleanup?

[laniakea64]

During recent research for vim-just I ran across this - https://deps.rs/crate/just

Where couple things jumped out:

1. just's dependency on regex states version 1.5.4, which the deps.rs link flags as a security vulnerability. However, just is actually using regex version 1.10.3 -
   

   just/Cargo.lock

   Lines 715 to 718 in c237c00

   	[[package]]
   	name = "regex"
   	version = "1.10.3"
   	source = "registry+https://github.com/rust-lang/crates.io-index"

   
   Should this be updated in Cargo.toml to prevent false positives?

2. just declares a development dependency on yaml-rust, which is unmaintained. AFAICT this dependency is completely unused in today's just code, seems its use was removed in bb5b962 ?

[casey]

I think this was fixed in #1999.