[benfrank241]

Daily security sweep for the root Cargo.lock (cargo). Dependabot alerts on this repo return 0 in every state, so the sweep found these advisories by auditing the lockfile against OSV / GitHub Advisory DB, and there are no alert numbers. Recommend enabling Settings → Code security → Dependabot alerts.

Supersedes #39. This PR includes all of #39's bumps (bytes, quinn-proto, rand, rustls-webpki, tar), carries them further where new advisories now require it, and adds the advisories published since 2026-09-21. Once this merges, #39 can be closed. Both PRs edit only Cargo.lock.

Advisories cleared (24 unique)

Crate	From → To	Advisories
quinn-proto	0.11.13 → 0.11.18	GHSA-4w2j-m93h-cj5j / CVE-2026-25800, GHSA-6xvm-j4wr-6v98 / CVE-2026-31812, GHSA-465w-v9q3-7j98, GHSA-3g6h-r5qx-f6hq, GHSA-hmxj-32vh-65vr, GHSA-qfwj-vfxf-92j2, GHSA-2hv7-gw8g-gpq5
rustls-webpki	0.103.8 → 0.103.16	GHSA-82j2-j2ch-gfr8 / CVE-2026-93599, GHSA-965h-392x-2mh5 / CVE-2026-93600, GHSA-xgp8-3hg3-c2mh / CVE-2026-93601, GHSA-pwjx-qhcg-rvj4 / CVE-2026-93602, RUSTSEC-2026-0382 / CVE-2026-111943
rustls	0.23.35 → 0.23.46	GHSA-2mjx-qc3c-rqvc, GHSA-c8m5-c952-6cm4, GHSA-h2v8-394m-p7vv, GHSA-w44r-93j7-qv28
webpki-roots	1.0.4 → 1.0.10	RUSTSEC-2026-0381 / CVE-2026-111943
tar	0.4.44 → 0.4.46	GHSA-gchp-q4r4-x4ff / CVE-2026-33055, GHSA-j4xf-2g29-59ph / CVE-2026-33056, GHSA-3pv8-6f4r-ffg2
tokio	1.48.0 → 1.51.6	RUSTSEC-2026-0386
bytes	1.11.0 → 1.11.1	GHSA-434x-w66g-qw3r / CVE-2026-25541
rand	0.8.5 → 0.8.6, 0.9.2 → 0.9.3	GHSA-cq8v-f236-94qc
anyhow	1.0.100 → 1.0.103	RUSTSEC-2026-0190
event-listener	5.4.1 → 5.4.2	RUSTSEC-2026-0221

Each crate went to its lowest patched version with cargo update -p <crate> --precise <ver>. Cargo.toml is unchanged.

Expected lock churn, with the cause of each change

• quinn-proto 0.11.18 depends on rand 0.10, which adds rand 0.10.3, rand_core 0.10.1, rand_pcg 0.10.2, chacha20, cpufeatures 0.3.1, getrandom 0.4.3 and r-efi 6. 0.11.17 would avoid this, but it leaves GHSA-465w-v9q3-7j98 and GHSA-3g6h-r5qx-f6hq open.
• tokio 1.51.6 pulls tokio-macros 2.7.2 (which uses syn 3.0.9), mio 1.2.4, socket2 0.6.5 and libc 0.2.191.
• event-listener 5.4.2 no longer depends on concurrent-queue, so that crate is removed.

Not included (backlog)

• zip 2.4.2 and 4.6.1: GHSA-vv5m-jxxh-4627, GHSA-4v9h-p7m9-rh26, GHSA-4684-h2q9-2vcp. The first fixed version is 9.0.0, a major bump. pg0 declares zip = "2" (Windows-only), and the 4.6.1 copy comes from postgresql_archive 0.20, so 4.6.1 also needs an upstream release. Maintainer decision.
• instant 0.1.13: RUSTSEC-2024-0384 (unmaintained, no fix). It is pulled in through parking_lot 0.11 ← reqwest-retry 0.7 ← postgresql_archive.

Verification (from ci.yml)

• cargo build --release succeeds.
• cargo test --release: 12 passed, 0 failed.
• I did not build the Windows x86_64-pc-windows-msvc cross target locally. CI covers it.
• OSV audit after the change: only the zip and instant items listed above remain.

🤖 Generated with Claude Code