chore(deps): nightly audit 2026-08-05

[po4yka]

Task

Nightly dependency and security audit (scheduled), not tied to a docs/tasks/issues/ entry.

Summary

Automated nightly sweep of the Rust Cargo workspace (native/rust/, 116 crates) and the
Gradle/Kotlin frontend (13 modules + build-logic). Only SAFE-bucket changes are applied here;
everything else is reported below for a human decision.

Applied

Rust

• similar: 3.1.1 → 3.1.2 (patch). Used only by golden-test-support (test-only diffing
  helper for golden fixtures) — no production code path. Verified with
  cargo check --locked -p golden-test-support and a full-workspace
  cargo metadata --locked. Applied as a hand-scoped Cargo.lock edit (not cargo update)
  because the resolver's own --precise pass additionally shifted an unrelated syn duplicate
  edge (derive-deftly-macros's syn 3.0.3 → syn 2.0.119); that incidental churn was reverted
  to keep this diff to exactly the intended crate.

Gradle

• compose-preview-plugin (ee.schimke.composeai.preview): 0.19.25 → 0.19.34 (patch, 9
  releases behind). Build-time-only Compose preview renderer, zero runtime/production impact.
• testing/socket-bind-probe/build.gradle.kts: hardcoded CMake 3.22.1 → reads the shared
  ripdpi.nativeCmakeVersion Gradle property (3.31.6 in gradle.properties), same as every
  other native module via ripdpi.android.rust-native. This is a version-alignment fix for a
  cross-module divergence found during the audit (see Conflicts), not a version-catalog bump.

Security

• No new RUSTSEC advisories. cargo audit --json reports exactly the four items already
  tracked and waived in native/rust/deny.toml / native/rust/advisory-waivers.toml, none
  expired (today: 2026-08-05):
  • RUSTSEC-2023-0071 (Marvin Attack, rsa 0.9.10 / 0.10.0-rc.18, via Arti and russh) —
    waived, expires 2026-11-02, no safe upgrade path on either dependency chain.
  • RUSTSEC-2025-0069 (unmaintained daemonize 0.5.0) — waived, expires 2026-10-11.
  • RUSTSEC-2025-0141 (unmaintained bincode 2.0.1, transitive via Arti) — waived, expires
    2026-11-02.
  • RUSTSEC-2024-0436 (unmaintained paste 1.0.15, transitive via netlink-packet-core) —
    waived, expires 2026-10-11.
• cargo deny --locked check passes clean (advisories ok, bans ok, licenses ok, sources ok).
  The only output is pre-existing warn-level noise already tolerated by deny.toml: duplicate
  RustCrypto crate versions (from russh's exact-pinned RC-crypto graph coexisting with the
  workspace's stable crypto versions) and internal path-crate wildcard-dependency warnings — no
  change from baseline.

Needs review

• Rust base64: 0.23.0 → 0.23.1 (patch on paper, but withheld). base64 is a direct
  dependency of five networking/protocol crates (ripdpi-vless, ripdpi-shadowsocks,
  ripdpi-ssh, ripdpi-warp-core, ripdpi-naiveproxy) where it encodes handshake/credential
  data on the wire — falls under the "touching networking" carve-out regardless of semver level.
• compose-preview.md doc drift (not a dependency change, flagging for awareness): the rule
  file at .claude/rules/compose-preview.md documents the plugin as pinned at 0.16.59, which
  was already stale against the pre-audit catalog value (0.19.25) before this PR's bump to
  0.19.34. Out of scope for a dependency-audit diff; a maintainer should refresh the doc
  separately.

Major

• Rust arti-client: 0.44.0 → 0.45.0. 0.x release, so a minor-version bump is a semver
  break by Cargo's own convention; requires a Cargo.toml range edit (current pin "0.44.0" is
  caret-range, does not admit 0.45). Tor client crate — networking and crypto surface.
• Rust tor-rtcompat: 0.44.0 → 0.45.0. Companion crate to arti-client, released in
  lockstep; same breaking-bump situation and the same networking/crypto sensitivity.
• No major-version updates found on the Gradle side — the version catalog was already current on
  every other entry (54 [versions] keys checked against live Maven Central / Google Maven /
  Gradle Plugin Portal metadata; only compose-preview-plugin was behind, and only by patches).

Conflicts

• Resolved in this PR: testing/socket-bind-probe/build.gradle.kts hardcoded
  externalNativeBuild.cmake.version = "3.22.1", diverging from the ripdpi.nativeCmakeVersion
  pin (3.31.6) that every other native-build module reads from gradle.properties. Now reads
  the same property.
• No drift found (informational only, no action taken): two other build-time version pins
  live outside libs.versions.toml's [versions] table — the ktlint-core pin
  (ripdpi.android.ktlint.gradle.kts, 1.8.0) and the foojay-resolver-convention plugin
  version in settings.gradle.kts (1.0.0) — but both already match their respective latest
  releases, so there's nothing to reconcile today; noting them so a future bump doesn't get
  missed since neither has a catalog anchor.
• build-logic's convention plugins source every version from the root gradle/libs.versions.toml
  catalog directly (versionCatalogs { create("libs") { from(files("../gradle/libs.versions.toml")) } })
  — there is no second catalog for it to diverge from.

Test plan

• cargo audit --json — 0 new vulnerabilities; all 4 findings match existing waivers.
• cargo deny --locked check — passes (advisories ok, bans ok, licenses ok, sources ok).
• cargo metadata --locked --format-version=1 — full 116-crate workspace lockfile resolves
  cleanly after the similar bump.
• cargo check --locked -p golden-test-support — the one crate touched by the similar bump
  builds clean.
• ./gradlew help (online, no --offline) — build-logic:convention compiles, and every Gradle
  module including :testing:socket-bind-probe reaches project configuration successfully (the
  compose-preview-plugin bump and the CMake-property edit both evaluate without error). The
  run then fails on SDK location not found — this sandboxed audit environment has no Android
  SDK installed, so assembleDebug / testDebugUnitTest / staticAnalysis could not be run
  here; CI should re-verify those gates.
• Outdated-dependency detection for Rust used direct crates.io sparse-index queries rather than
  cargo outdated — that tool's temp-workspace copy has a pre-existing bug with this repo's
  [patch.crates-io] boring-sys = { path = "vendor/boring-sys" } override (fails with
  failed to read .../vendor/boring-sys/Cargo.toml even with --exclude/--ignore-external-rel)
  and could not be worked around in this run.

Checklist

• No baseline files extended (detekt, lint, LoC)
• timeout-minutes added to any new CI job — N/A, no CI jobs added
• Native ABI matrix not broken (if touching native builds) — CMake version pin realigned to
  the existing shared value, no ABI/toolchain change
• Non-rooted device path still works (if touching VPN/root features) — N/A, no VPN/root code
  touched

---

Generated by Claude Code