[bkataru]

What

A lockfile-only bump that moves five crates to the newest version their declared semver
ranges already allow.

crate	from	to	advisories that stop matching this copy
quinn-proto	0.11.15	0.11.18	RUSTSEC-2026-0338, -0339, -0340, -0341, -0342
rustls	0.23.39	0.23.46	RUSTSEC-2026-0285, -0346, -0348, -0349
rustls-webpki	0.103.13	0.103.16	RUSTSEC-2026-0382
webpki-root-certs	1.0.7	1.0.10	RUSTSEC-2026-0383
webpki-roots	1.0.7	1.0.10	RUSTSEC-2026-0381

aws-lc-rs and aws-lc-sys move with rustls 0.23.46; they are forced by that move, not
incidental drift.

Measured effect

cargo audit on the lockfile before and after:

	before	after	rows cleared
with the repository's suppressions	14	3	11
with the suppressions removed	21	9	12

The audit gate still reports three findings

They are the legacy rustls 0.22.4 and rustls-webpki 0.102.8 copies: their dependency
requires rustls ^0.22, and that series has no release at or above the patched floor, so no
in-repo bump clears them. Both are reachable from the CLI, so they are reported rather than
suppressed - a suppression entry would hide a reachable advisory. Tracked in #153.

h2 0.3.27 (RUSTSEC-2026-0258) sits on the same line and stays suppressed for the same
reason.

RUSTSEC-2026-0285 leaves the suppression list

.cargo/audit.toml carried RUSTSEC-2026-0285 with the reason "externally blocked ... pins
rustls below the patched floor". The resolver moves that copy to 0.23.46 inside its own
range, so the reason did not describe what the resolver does. With the bump applied the
advisory matches no locked copy, so the entry is removed instead of being left to suppress
nothing.

Fixes #77
Fixes #143
Fixes #144
Fixes #145
Fixes #146
Fixes #147
Fixes #150

RUSTSEC-2026-0346 and RUSTSEC-2026-0349 are only partly addressed: their 0.23 copy is
fixed here, their legacy 0.22.4 copy is not, so #148, #149, #151 and #152 stay open.

[bkataru]

Correction from the lane that opened #84: CI does run on main, and it was green. My "main receives no CI" claim was wrong — I read a truncated gh run list as complete and reported absence as fact.

Relevant here only because it changes one thing in my earlier comment on this PR: I said "main is unmeasured" and treated that as worse than red. It is neither — main was audited green on 2026-06-14 and has not changed since, so the baseline this PR diffs against is the baseline CI approved.

The red gates on #82 remain exactly as established: cargo audit (6 here, 7 on de893a9) and Check & Lint (4 pre-existing #[async_trait] lints), both failing on the pull_request trigger, both pre-existing relative to a Cargo.lock-only diff.

[bkataru]

Subsumed by a single verified lockfile, posted on #83. This PR's CI cannot go green on its own: cargo audit fails on advisories outside its scope, and Check & Lint fails on clippy::double_must_use. Combining this bump with async-trait 0.1.92 + rustls 0.23.45 + quinn-proto 0.11.15 + crossbeam-epoch 0.9.20 + h2 0.4.16 + plist 1.10.1 takes the gate from 7 vulnerabilities to 1 with clippy exit 0 and 1826/1826 nextest green (lockfile sha 9dc234af6eba1997, lint result carries a planted-violation control at exit 101). No new PR opened — this needs review, not re-derivation. One caveat: h2 0.3.27 remains and no lockfile can clear it (see #81).

[bkataru]

This branch was rebased onto current main and its advisory commit replaced, so the diff is now
two files instead of the 92-file, +8,621-line diff the branch carried.

The branch held 553 commits, 45 of them after the merge-base with main. Those 45 fall into
three classes, and the rebase treats them three different ways: 39 were reported as previously
applied upstream and skipped; the one advisory commit became empty when it was replayed against
the current lockfile and was dropped; and the five merge commits were flattened, their
constituents being among those 39. Nothing was dropped that was not already in main.

The replacement commit carries the measured bump set rather than a single rustls 0.23.45
move:

crate	from	to
quinn-proto	0.11.15	0.11.18
rustls	0.23.39	0.23.46
rustls-webpki	0.103.13	0.103.16
webpki-root-certs	1.0.7	1.0.10
webpki-roots	1.0.7	1.0.10

0.23.46 rather than 0.23.45, because RUSTSEC-2026-0346, -0348 and -0349 are patched only
at >= 0.23.46; the 0.23.45 floor clears RUSTSEC-2026-0285 alone.

cargo audit: 14 findings -> 3 with the repository's suppressions, 21 -> 9 without them. The
three that remain are the legacy rustls 0.22.4 / rustls-webpki 0.102.8 copies, tracked in
#153.

Two corrections are visible in this branch's history, both made before the diff was final: the
commit message first said "eight advisories" where its own table enumerates twelve, and this
comment's earlier wording gave the branch as a 45-commit line and did not account for the five
merge commits.