ci: lapsed security exceptions, MongoDB 7.0 fixtures, zstd 0.14.3 for four advisories

.github/workflows/ci.yml

@@ -315,7 +315,7 @@ jobs:
       - name: Install and verify Redis 8.4.0 with TLS
         run: python3 scripts/ci/install-redis.py
       - name: Pull MongoDB before the bounded fixture startup wait
-        run: docker pull mongo:8
+        run: docker pull mongo:7.0  # 8.x refuses Linux 6.19+ (SERVER-121912)
       - name: Install WASI 0.2 adapter runtime and C toolchain
         run: |
           rustup target add --toolchain nightly-2026-08-20 wasm32-wasip2

Cargo.toml

@@ -51,7 +51,7 @@ ring = "0.17"
 rustls-pki-types = "1"
 rcgen = { version = "0.13", default-features = false, features = ["ring", "pem"] }
 tungstenite = { version = "0.30", default-features = false, features = ["handshake"] }
-zstd = { version = "0.13", default-features = false }
+zstd = { version = "0.14", default-features = false }
 twox-hash = { version = "2", default-features = false, features = ["xxhash64"] }
 fastrand = "2"
 rand = { version = "0.8", features = ["small_rng"] }

scripts/ci/policy.toml

@@ -15,23 +15,4 @@ banned = [
 ]
 
 # Exact security fixes; each exception stops at registry publication + seven days.
-[[security-exceptions]]
-crate = "ctutils"
-version = "0.4.4"
-advisory = "RUSTSEC-2026-0385"
-reason = "Patched constant-time mask generation and u128 comparisons"
-expires = 2026-10-30
-
-[[security-exceptions]]
-crate = "rustls-webpki"
-version = "0.103.16"
-advisory = "RUSTSEC-2026-0382"
-reason = "Reject distrusted emSign intermediate public keys"
-expires = 2026-10-27
-
-[[security-exceptions]]
-crate = "webpki-roots"
-version = "1.0.10"
-advisory = "RUSTSEC-2026-0381"
-reason = "Remove the distrusted emSign root from bundled roots"
-expires = 2026-10-26
+# None are pending: every exception lapses once its fix clears the soak.

scripts/ci/test_servers.py

@@ -414,7 +414,7 @@ def test_docker_wrapper_records_only_its_private_container(self):
             self.assertEqual(args[args.index('--label') + 1], 'turnloop.fixture=' + str(tools))
             self.assertEqual(args[args.index('--volume') + 1], str(root) + ':' + str(root))
             self.assertEqual(args[args.index('--user') + 1], f'{os.getuid()}:{os.getgid()}')
-            self.assertEqual(args[-4:], ['mongod', 'mongo:8', '--port', '32123'])
+            self.assertEqual(args[-4:], ['mongod', 'mongo:7.0', '--port', '32123'])
             recorded = json.loads((tools / 'docker-fixtures.json').read_text())
             self.assertEqual(recorded, [args[args.index('--name') + 1]])
             self.assertTrue(recorded[0].startswith('turnloop-fixture-'))

scripts/test-servers.py

@@ -848,7 +848,9 @@ def prepare_docker_wrappers():
 import json, os, pathlib, subprocess, sys, uuid
 root = pathlib.Path(__file__).resolve().parents[1]
 name = pathlib.Path(sys.argv[0]).name
-image = 'mongo:8'
+# MongoDB 8.x refuses to start on Linux 6.19+ (SERVER-121912, TCMalloc rseq);
+# 7.0 has no such check and covers every feature the suite uses.
+image = 'mongo:7.0'
 container = 'turnloop-fixture-' + uuid.uuid4().hex
 record = root / 'docker-fixtures.json'
 existing = json.loads(record.read_text()) if record.exists() else []