chore(deps): bump the rust-dependencies group, with the audits it needs

knowledge/log.md

@@ -2,6 +2,8 @@
 
 ## 2026-10-15
 
+* **Operations / Security**: The `rust-dependencies` group bump (proptest 1.11.0 -> 1.12.0, serde_json 1.0.151 -> 1.0.154, syn 3.0.7 -> 3.0.8, and rand_xorshift 0.4.0 -> 0.5.0 behind proptest) was green on every job except Audit, where `cargo vet --locked` reported eleven unvetted crates. proptest 1.12 is the reason: it pulls a borsh serialization chain into the dev tree, adding `bit-set`, `bit-vec`, `borsh`, `borsh-derive`, `core_detect`, `proc-macro-crate` and `toml_edit` where a patch-level dev bump looks like it should add nothing. `cargo tree -e normal -i proptest` finds no path, so the whole chain is dev-only and takes `safe-to-run` exemptions, matching how proptest and rand_xorshift were already carried; the two shipped crates took hand delta audits at `safe-to-deploy`. serde_json's delta is narrowing (`-0` keeps its sign under arbitrary_precision, `as_f32` filters non-finite, invalid UTF-8 is reported at the first bad byte) and syn's only rejects `<-` and stops mis-parsing `->` as subtraction. The one thing worth remembering about the serde_json audit: its new UTF-8 position arithmetic saturates in `as_str`, which this tree compiles, but not in `begin_raw_buffering`, which needs the `raw_value` feature this tree does not enable - so enabling `raw_value` later means re-checking that subtraction. Stale `proptest` 1.11.0 and `rand_xorshift` 0.4.0 exemptions were dropped rather than left behind. The general rule, same as #2706/#2720: a dependabot group bump that adds crates cannot go green on its own, because nothing in the bump records the audits the new crates need.
+
 * **Security / Operations**: Nightly run 263 went red on the Advisory Audit with 15 vulnerabilities in the root and fuzz lockfiles and 11 in `examples/hyperlight/host` — none from a tree that changed. Two upstream batches landed on 2026-10-14: eleven `wasmtime` advisories against the pinned 48.0.5 (RUSTSEC-2026-0353 through -0359 and -0361 through -0364: host panics reachable from guest code, an unaligned-host-data bug, and an unmetered component-model handle table) and four `rustls` advisories against 0.23.45 (RUSTSEC-2026-0346 through -0349: `Debug` impls exposing TLS secrets, buffered application data sent to the outer server after ECH rejection, pre-authentication Brotli certificate decompression allocating up to 1 GiB, and an unauthenticated `ServerHello` downgrading later connections to classical key exchange). The wasmtime pin moves `=48.0.5` -> `=48.0.6`, which is the fix release on the 48 line and keeps MSRV at 1.95.0, matching `rust-toolchain.toml`; 49.0.3 also carries the fixes but needs rustc 1.96, so the reason the pin exists is unchanged and the dependabot `ignore` entries stay. `rustls` is a caret dependency and moves 0.23.45 -> 0.23.46. All three cargo lockfiles are updated together, since the fuzz lockfile resolves the root workspace and `examples/hyperlight/host` carries its own. No guest rebuild is needed for the wasmtime bump: `build.rs` recompiles the `.cwasm`, per [cpython-wasm](runtimes/cpython-wasm.md). The general point: an exact pin held for an MSRV reason still has to move on the patch line when that line is the advisory fix — the pin is not a reason to stay vulnerable.
 
 ## 2026-10-13

supply-chain/audits.toml

@@ -538,6 +538,12 @@ criteria = "safe-to-deploy"
 delta = "0.103.14 -> 0.103.15"
 notes = "Reviewed complete runtime delta: FIPS status reports underlying AWS-LC signature implementation status. Certificate parsing, verification algorithms and input bounds unchanged."
 
+[[audits.serde_json]]
+who = "Mykhailo Chalyi <mike@chaliy.name>"
+criteria = "safe-to-deploy"
+delta = "1.0.151 -> 1.0.154"
+notes = "Reviewed the published delta across 1.0.152-1.0.154. Behavior changes are narrowing or diagnostic: '-0' no longer parses to I64(0) so the sign survives in arbitrary_precision mode; Number::as_f32 filters non-finite results, fixing comparison of large non-integer values against f32::INFINITY; invalid UTF-8 is reported at the first bad byte instead of the end of the token; lexical/math.rs changes are max_value() to MAX renames in code and comments only. Under preserve_order the IndexMap hasher becomes explicit, std::hash::RandomState with the std feature and foldhash::fast::RandomState without it, which upstream documents as minimal HashDoS resistance; that path needs preserve_order, which this tree does not enable. The new UTF-8 position arithmetic is the only part worth re-checking by a future user: as_str, which is not feature-gated and is what this tree compiles, uses saturating_sub and cannot underflow, while begin_raw_buffering subtracts from position.column without saturation and is reachable only under the raw_value feature, also not enabled here. Worst case in either is a wrong column in an error message. No unsafe anywhere in the diff, no new filesystem, network, process or environment access, no build script, and the only dependency addition is the foldhash hasher behind no-std preserve_order. Source safety review of the delta, not a full crate review."
+
 [[audits.signal-hook]]
 who = "Mykhailo Chalyi <mike@chaliy.name>"
 criteria = "safe-to-deploy"
@@ -568,6 +574,12 @@ criteria = "safe-to-deploy"
 delta = "3.0.6 -> 3.0.7"
 notes = "Reviewed complete published package diff: one production change in src/expr.rs, the rest tests and a version stamp. Parsing a labelled construct now also checks that the token after the label is not '::', so 'label: ...' is no longer matched when the source actually continues with a path separator. No unsafe code, no new dependencies, no build scripts, no host access."
 
+[[audits.syn]]
+who = "Mykhailo Chalyi <mike@chaliy.name>"
+criteria = "safe-to-deploy"
+delta = "3.0.7 -> 3.0.8"
+notes = "Reviewed the complete published delta: two production files plus a version stamp and tests. Operator parsing is narrowed, not widened. BinOp parsing no longer treats a leading '-' as subtraction when the token is actually '->', nor '<' as less-than when the token is '<-', and the two cast/comparison loops in expr.rs now return a parse error naming '<-' instead of silently breaking out. Token consumption stays bounded and the syntax tree construction is unchanged. No unsafe, no new dependencies, no build script, no host access."
+
 [[audits.thin-vec]]
 who = "Mykhailo Chalyi <mykhailo.chalyi-contractor@procore.com>"
 criteria = "safe-to-deploy"