chore(deps): nightly audit 2026-08-04

[po4yka]

Task

N/A — scheduled nightly dependency and security audit, not tied to a docs/tasks/issues/ entry.

Summary

Nightly automated audit of the Rust Cargo workspace (native/rust, 223 crate entries across the workspace graph) and the Gradle version catalog (gradle/libs.versions.toml, 19 modules). Only the SAFE bucket (patch-level bumps with no crypto/networking/async-runtime/JNI-FFI surface) is applied here. Everything else is reported below for a human decision — nothing in Needs Review or Major was touched.

Applied

Rust

• lru: 0.18.1 → 0.18.2 (lockfile-only patch bump via cargo update -p lru --precise 0.18.2; general-purpose cache data structure, no crypto/net/async/FFI surface, consumed by ripdpi-dns-resolver, ripdpi-runtime-dns-cache, ripdpi-tunnel-core, ripdpi-flow-app-attribution)

Gradle

• ksp: 2.3.10 → 2.3.11 (patch bump, KSP annotation processor)
• compose-preview-plugin: 0.19.12 → 0.19.25 (patch bump within the 0.19.x series; build-time-only Compose preview image renderer, not shipped in the app)

Security

• RUSTSEC-2023-0071 (rsa "Marvin Attack" timing side-channel) — already tracked and waived in native/rust/deny.toml / advisory-waivers.toml. Affects rsa 0.9.10 (via arti-client → Tor) and rsa 0.10.0-rc.18 (via russh 0.62.5, the SSH relay's exact-pinned RustCrypto stack). No fix available upstream on either path as of this run (russh 0.62.5 is still exact-pinned to rsa =0.10.0-rc.18; no 0.63 release yet). The waiver expires 2026-08-12 — 8 days from this run and will fail cargo-deny-advisories/CI on that date until reviewed. Tracking: docs/tasks/issues/unpin-russh-after-rsa-advisory-fix.md.
• RUSTSEC-2025-0141 (bincode unmaintained) — new, not currently waived. bincode 2.0.1 enters transitively via tor-netdir → typed-index-collections (part of the Arti/Tor stack). Bincode's maintainers ceased development permanently (Dec 2025); no patched version exists. Needs a deny.toml waiver (with owner/expiry/tracking-issue per the repo's governance) or an upstream fix in Arti's dependency tree. Unresolved.
• RUSTSEC-2026-0221 (event-listener unsound Send/Sync leak via StackSlot) — new, not currently waived. event-listener 5.4.1 is unsound: a !Send tag set via Event::with_tag can cross threads through StackSlot::wait. A patched 5.4.2 exists on crates.io. Withheld from SAFE despite being a straightforward patch because the dependency chain is async-runtime- and tunnel-adjacent: event-listener-strategy → async-channel → blocking → tun-rs (the TUN driver in ripdpi-tunnel-core/ripdpi-tunnel-android), and separately tor-dirmgr → arti-client → ripdpi-tor. See Needs Review.
• native/rust/fuzz/Cargo.lock (separate, dev-only fuzz-tooling workspace, not shipped): anyhow 1.0.102 flagged unsound by RUSTSEC-2026-0190 (Error::downcast_mut()). Out of scope for this run (separate lockfile, not part of the app's dependency graph) but noted for awareness.
• cargo deny --locked check (advisories, bans, licenses, sources): ok. Pre-existing multiple-versions/wildcard bans warnings are unchanged and already tolerated by deny.toml policy (warn, not deny).

Needs review

• event-listener 5.4.1 → 5.4.2 (Rust) — patches RUSTSEC-2026-0221 (unsound Send/Sync). Withheld because the dependency chain is async-runtime/tunnel-adjacent (tun-rs, arti-client) — policy requires human review for any such change regardless of semver level, even a security fix. Suggested fix once reviewed: cargo update -p event-listener --precise 5.4.2 in its own PR.
• rand (rand_09 alias) =0.9.3 → 0.9.5 available (Rust) — exact-pinned crypto RNG (os_rng, std_rng features). Patch-level, but crypto crates never auto-apply regardless of semver level per policy.

Major

• arti-client 0.44.0 → 0.45.0 (Rust) — Tor client backend for ripdpi-tor. 0.x minor bump (breaking under Cargo semver rules); requires a Cargo.toml version-requirement edit, not just a lockfile update. Upstream changelog not reachable from this environment to summarize breaking changes — review manually before bumping.
• tor-rtcompat 0.44.0 → 0.45.0 (Rust) — paired with arti-client; must move in lockstep if arti-client is bumped.

Conflicts

None found. The Gradle build uses a single centralized version catalog (gradle/libs.versions.toml) with no per-module hardcoded dependency versions, no resolutionStrategy/force overrides, and no secondary version catalogs — so no cross-module version divergence is possible by construction.

Test plan

• cargo update -p lru --precise 0.18.2 (Rust workspace) — lockfile-only change, diff limited to the lru entry.
• cargo check --locked -p ripdpi-dns-resolver -p ripdpi-runtime-dns-cache -p ripdpi-tunnel-core -p ripdpi-flow-app-attribution (all direct consumers of lru) — passed clean.
• cargo deny --locked --manifest-path native/rust/Cargo.toml check — advisories/bans/licenses/sources all ok.
• python3 scripts/ci/check_rust_advisory_waivers.py — waiver governance metadata current.
• cargo audit --file native/rust/Cargo.lock — 2 known/waived vulnerabilities (RUSTSEC-2023-0071), 3 unmaintained + 1 unsound warnings (see Security).
• ./gradlew help (Gradle, after ksp/compose-preview-plugin bump) — resolved the new plugin/dependency versions and configured every module (:app, all :core:*, :testing:socket-bind-probe) cleanly; the only failure was SDK location not found, an environment limitation (no ANDROID_HOME in this sandbox) unrelated to the version bumps.

Checklist

• No baseline files extended (detekt, lint, LoC)
• timeout-minutes added to any new CI job — N/A, no CI job added
• Native ABI matrix not broken (if touching native builds) — lockfile-only Rust change, no ABI/API surface touched
• Non-rooted device path still works (if touching VPN/root features) — N/A, no VPN/root code touched

---

Generated by Claude Code