From b05a0fe2ae0e97bc0560ec21bb53842183703d54 Mon Sep 17 00:00:00 2001 From: lym953 <10097700+lym953@users.noreply.github.com> Date: Tue, 13 Oct 2026 13:33:26 -0400 Subject: [PATCH 1/3] chore(deps): bump quinn-proto to 0.11.19 (RUSTSEC-2026-0338 to 0342) RustSec added five advisories against quinn-proto 0.11.15 on 2026-10-12, so cargo audit fails on main. quinn-proto is in the lock file only as an optional dependency of reqwest (HTTP/3), and no build compiles it. Co-Authored-By: Claude Opus 5.5 --- Cargo.lock | 64 +++++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 56 insertions(+), 8 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 17e928f5..a7bdf13d 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -345,6 +345,17 @@ version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" +[[package]] +name = "chacha20" +version = "0.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" +dependencies = [ + "cfg-if", + "cpufeatures 0.3.1", + "rand_core 0.10.1", +] + [[package]] name = "chrono" version = "0.4.45" @@ -432,6 +443,15 @@ dependencies = [ "libc", ] +[[package]] +name = "cpufeatures" +version = "0.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566" +dependencies = [ + "libc", +] + [[package]] name = "crc32fast" version = "1.5.0" @@ -1104,11 +1124,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd" dependencies = [ "cfg-if", - "js-sys", "libc", "r-efi 5.3.0", "wasip2", - "wasm-bindgen", ] [[package]] @@ -1118,10 +1136,13 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555" dependencies = [ "cfg-if", + "js-sys", "libc", "r-efi 6.0.0", + "rand_core 0.10.1", "wasip2", "wasip3", + "wasm-bindgen", ] [[package]] @@ -2708,14 +2729,15 @@ dependencies = [ [[package]] name = "quinn-proto" -version = "0.11.15" +version = "0.11.19" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4fcb935c5bec503c2f0e306bdd3e58bb9029dcb14fa8d9ac76e3a5256ac0763e" +checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe" dependencies = [ "bytes", - "getrandom 0.3.4", + "getrandom 0.4.2", "lru-slab", - "rand 0.9.4", + "rand 0.10.3", + "rand_pcg", "ring", "rustc-hash", "rustls", @@ -2783,6 +2805,17 @@ dependencies = [ "rand_core 0.9.5", ] +[[package]] +name = "rand" +version = "0.10.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af" +dependencies = [ + "chacha20", + "getrandom 0.4.2", + "rand_core 0.10.1", +] + [[package]] name = "rand_chacha" version = "0.3.1" @@ -2821,6 +2854,21 @@ dependencies = [ "getrandom 0.3.4", ] +[[package]] +name = "rand_core" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69" + +[[package]] +name = "rand_pcg" +version = "0.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a" +dependencies = [ + "rand_core 0.10.1", +] + [[package]] name = "rand_xorshift" version = "0.4.0" @@ -3385,7 +3433,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba" dependencies = [ "cfg-if", - "cpufeatures", + "cpufeatures 0.2.17", "digest", ] @@ -3396,7 +3444,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283" dependencies = [ "cfg-if", - "cpufeatures", + "cpufeatures 0.2.17", "digest", ] From 5ef7e5cb2cc8aa456a1a1f4e725a896bcd4f7e1a Mon Sep 17 00:00:00 2001 From: lym953 <10097700+lym953@users.noreply.github.com> Date: Tue, 13 Oct 2026 13:41:42 -0400 Subject: [PATCH 2/3] chore: add LICENSE-3rdparty.csv rows for the quinn-proto 0.11.19 dependencies Co-Authored-By: Claude Opus 5.5 --- LICENSE-3rdparty.csv | 3 +++ 1 file changed, 3 insertions(+) diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv index c2105f3b..b1ce0464 100644 --- a/LICENSE-3rdparty.csv +++ b/LICENSE-3rdparty.csv @@ -34,6 +34,7 @@ cc,https://github.com/rust-lang/cc-rs,MIT OR Apache-2.0,Alex Crichton cexpr,https://github.com/jethrogb/rust-cexpr,Apache-2.0 OR MIT,Jethro Beekman cfg-if,https://github.com/rust-lang/cfg-if,MIT OR Apache-2.0,Alex Crichton +chacha20,https://github.com/RustCrypto/stream-ciphers,MIT OR Apache-2.0,RustCrypto Developers chrono,https://github.com/chronotope/chrono,MIT OR Apache-2.0,The chrono Authors clang-sys,https://github.com/KyleMayes/clang-sys,Apache-2.0,Kyle Mayes combine,https://github.com/Marwes/combine,MIT,Markus Westerlind @@ -222,6 +223,8 @@ r-efi,https://github.com/r-efi/r-efi,MIT OR Apache-2.0 OR LGPL-2.1-or-later,The rand,https://github.com/rust-random/rand,MIT OR Apache-2.0,"The Rand Project Developers, The Rust Project Developers" rand_chacha,https://github.com/rust-random/rand,MIT OR Apache-2.0,"The Rand Project Developers, The Rust Project Developers, The CryptoCorrosion Contributors" rand_core,https://github.com/rust-random/rand,MIT OR Apache-2.0,"The Rand Project Developers, The Rust Project Developers" +rand_core,https://github.com/rust-random/rand_core,MIT OR Apache-2.0,The Rand Project Developers +rand_pcg,https://github.com/rust-random/rngs,MIT OR Apache-2.0,The Rand Project Developers rand_xorshift,https://github.com/rust-random/rngs,MIT OR Apache-2.0,"The Rand Project Developers, The Rust Project Developers" redox_syscall,https://gitlab.redox-os.org/redox-os/syscall,MIT,Jeremy Soller ref-cast,https://github.com/dtolnay/ref-cast,MIT OR Apache-2.0,David Tolnay From 05880eb3e97663f84a4c03d6e5b9a2654a45e7a3 Mon Sep 17 00:00:00 2001 From: lym953 <10097700+lym953@users.noreply.github.com> Date: Wed, 14 Oct 2026 15:55:33 -0400 Subject: [PATCH 3/3] chore: ignore RUSTSEC-2026-0346 to 0349 until a FIPS-certified aws-lc-rs exists The fix is in rustls 0.23.46, which requires aws-lc-rs >= 1.18 and so AWS-LC-FIPS 4.x, the same blocker as for RUSTSEC-2026-0285. Co-Authored-By: Claude Opus 5.5 --- .cargo/audit.toml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.cargo/audit.toml b/.cargo/audit.toml index 8e88df8d..0852f791 100644 --- a/.cargo/audit.toml +++ b/.cargo/audit.toml @@ -2,5 +2,14 @@ # aws-lc-rs >= 1.18, which pulls in AWS-LC-FIPS 4.x, pending FIPS 140-3 # certification. Remove this ignore once a FIPS-certified aws-lc-rs is # available. +# +# RUSTSEC-2026-0346 to 0349 are fixed in rustls >= 0.23.46, which has the same +# aws-lc-rs requirement. Remove them together with RUSTSEC-2026-0285. [advisories] -ignore = ["RUSTSEC-2026-0285"] +ignore = [ + "RUSTSEC-2026-0285", + "RUSTSEC-2026-0346", + "RUSTSEC-2026-0347", + "RUSTSEC-2026-0348", + "RUSTSEC-2026-0349", +]