fix(security): Consolidate remaining PRs with RUSTSEC-2026-0002 security fix

Cargo.toml

@@ -109,8 +109,8 @@ strip = true
 opt-level = 3
 debug = false
 
-# Security fix for RUSTSEC-2026-0002: IterMut violates Stacked Borrows  
 # Patch vulnerable lru 0.12.5 by replacing iced_glyphon with patched version
 # The patched version updates lru from 0.12.1 to 0.16.3 which includes the security fix
+# See SECURITY-FIX-RUSTSEC-2026-0002.md for details
 [patch.crates-io]
 iced_glyphon = { path = "vendor/iced_glyphon" }

crates/rustirc-plugins/src/api.rs

@@ -50,7 +50,7 @@ use std::error::Error;
 pub type PluginResult<T> = Result<T, Box<dyn Error + Send + Sync>>;
 
 /// Plugin capability flags
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
 pub struct PluginCapabilities {
     /// Can handle IRC messages and events
     pub handles_events: bool,
@@ -64,18 +64,6 @@ pub struct PluginCapabilities {
     pub network_access: bool,
 }
 
-impl Default for PluginCapabilities {
-    fn default() -> Self {
-        Self {
-            handles_events: false,
-            provides_commands: false,
-            provides_gui: false,
-            uses_storage: false,
-            network_access: false,
-        }
-    }
-}
-
 /// Plugin metadata and information
 #[derive(Debug, Clone)]
 pub struct PluginInfo {

crates/rustirc-scripting/src/api.rs

@@ -28,7 +28,6 @@
 //! - Integrate with external services
 
 use rustirc_core::events::{Event, EventBus};
-use rustirc_protocol::{Command, Message};
 use std::sync::Arc;
 
 /// Main scripting API interface
@@ -52,8 +51,12 @@ use std::sync::Arc;
 /// ```
 pub struct ScriptApi {
     /// Event bus for receiving and sending events
+    /// Reserved for future Phase 4+ features
+    #[allow(dead_code)]
     event_bus: Option<Arc<EventBus>>,
     /// Connection ID for script context
+    /// Reserved for future Phase 4+ features
+    #[allow(dead_code)]
     connection_id: Option<String>,
 }