chore(deps): keep the security audit passing on November's advisories

.github/workflows/test.yml

@@ -381,13 +381,16 @@ jobs:
         with:
           tool: cargo-audit,cargo-deny
 
-      # Ignored advisories are documented in deny.toml; cargo-audit does not
-      # read that file, so the ignore list is mirrored here. Keep the two in
-      # sync. RUSTSEC-2023-0071: unfixable rsa transitive dep via sqlx-mysql.
-      # RUSTSEC-2026-0235: rkyv 0.7.46 via webrtc/dtls (0.8.x is upgraded).
+      # cargo-audit reads every crate in Cargo.lock, including optional
+      # dependencies no enabled feature builds; cargo-deny (below) only checks
+      # what gets compiled. So this list holds advisories for crates that are
+      # locked but never built.
+      # RUSTSEC-2026-0459: libsqlite3-sys 0.30, locked through sqlx-sqlite.
+      # zm-api doesn't enable sqlx's sqlite feature, so it isn't compiled, and
+      # sqlx 0.9 caps it below the fixed 0.39.
       - name: Audit dependencies for known vulnerabilities
         run: >-
-          cargo audit --ignore RUSTSEC-2023-0071 --ignore RUSTSEC-2026-0235
+          cargo audit --ignore RUSTSEC-2026-0459
 
       - name: Check advisories, licenses and sources
         run: cargo deny check

deny.toml

@@ -6,27 +6,9 @@
 version = 2
 # RUSTSEC advisory IDs to ignore, with a justification comment each.
 ignore = [
-    # rsa "Marvin Attack" timing side-channel. No fixed `rsa` release exists and
-    # the crate is pulled in transitively (and unavoidably) by sqlx-mysql for the
-    # MariaDB/MySQL auth handshake — it is not used for any attacker-facing crypto
-    # in zm-api. Exploitation requires timing many RSA private-key operations;
-    # mitigated by a local/TLS database connection. Revisit when sqlx drops rsa.
-    "RUSTSEC-2023-0071",
-    # atomic-polyfill unmaintained. Deep transitive build-dep only
-    # (garde -> phonenumber -> postcard -> heapless), no safe upgrade available.
-    "RUSTSEC-2023-0089",
-    # rkyv 0.7.46 out-of-bounds read. The fix is rkyv >=0.8.17, but 0.7.46 is
-    # pulled transitively by the webrtc/dtls stack, which pins the 0.7 line; the
-    # directly-reachable rkyv (0.8.x) is already upgraded to 0.8.17. rkyv is not
-    # used to deserialize attacker-controlled archives in zm-api. Revisit when
-    # webrtc bumps rkyv to 0.8.
-    "RUSTSEC-2026-0235",
     # paste unmaintained. Build-time-only proc-macro helper, pulled transitively
     # (no runtime code); no maintained drop-in replacement across the tree.
     "RUSTSEC-2024-0436",
-    # proc-macro-error2 unmaintained. Build-time-only derive-macro dependency;
-    # unmaintained but not a vulnerability. Revisit if a maintained fork lands.
-    "RUSTSEC-2026-0173",
 ]
 
 [bans]