[illuzen]

The Security Audit job fails on main (and every open PR) after new RustSec advisories against pinned transitive deps. cargo audit is clean with this change; only the 8 pre-existing allowed warnings remain.

Crate	Before	After	Advisories
quinn-proto	0.11.16	0.11.19	RUSTSEC-2026-0338, 0339, 0340, 0341, 0342
rustls	0.23.45	0.23.46	RUSTSEC-2026-0346, 0347, 0348, 0349
self_update → zip	1.0.0-rc.6 → 8.6.0	1.3.1 → 9.0.5	RUSTSEC-2026-0367, 0368, 0369

self_update 1.3.1 is the first release on zip ^9; the features we use are unchanged and src/cli/update.rs / src/version_check.rs compile without edits. The quick-xml note on the old pin is superseded (1.3 is on quick-xml ≥ 0.41 as well).

RUSTSEC-2026-0344 (ruzstd 0.8.3) is added to a new .cargo/audit.toml ignore list rather than fixed. It's reached only through subxt-lightclient → smoldot, an optional subxt feature this crate never enables, so it's in Cargo.lock but never compiled (cargo tree -i smoldot --target all -e all prints nothing). Every smoldot release pins ruzstd ^0.8, so nothing on our side can bump it.

Verified locally: cargo audit (0.22.1, same as CI) clean, cargo clippy --workspace --all-targets --all-features --locked -D warnings clean, pinned-nightly fmt clean, update-module tests pass.

Made with Cursor

[n13]

Reviewer model: GPT-6.1 Sol

APPROVE — no blocking findings at 56062f58209d14ba4a8c82841bd82a0ade94d821 (base 413a6e23f7fc9ebbe8145d9cd887cd52a70cc933).

The dependency updates resolve the reported audit failures without changing the application API. The exception for RUSTSEC-2026-0344 is justified for the current feature set: cargo tree --locked --target all --all-features -e all -i smoldot and the equivalent ruzstd query both show no active dependency path. I also checked the shared updater configuration and its use by the update notification path.

Validation:

• SKIP_CIRCUIT_BUILD=1 cargo test --locked --lib cli::update::tests -- --nocapture: 4 passed; circuit generation skipped.
• cargo-audit 0.22.1 with a freshly fetched advisory database: 0 unignored vulnerabilities; the 8 existing warnings remain. The configured ignore list contains only RUSTSEC-2026-0344.
• Locked dependency resolution, changed TOML formatting, pinned-nightly Rust formatting, and git diff --check: passed. The worktree's tracked files remain unchanged.

CI at review time: Format and Security Audit passed; Linux/macOS builds and tests, Clippy/docs, and examples are still running. Both dependency-cooldown checks failed because the patched releases are younger than the required 30 days. Resolve that merge gate through the documented emergency bypass process or the cooldown period, and require the remaining CI checks to finish successfully.