chore(security): bump rustls-webpki + rand patch versions; ignore upstream-blocked hickory advisories

[vikgmdev]

Summary

Closes 3 RustSec vulnerabilities flagged by the CI Security Audit step + the rand unsoundness warning. Adds .cargo/audit.toml to document the 2 remaining hickory-proto advisories (both blocked on an iroh major bump). After this PR, cargo audit exits 0 and CI's Security Audit step turns green.

Supersedes PR #32 and PR #33.

What changed

Patch bumps (Cargo.lock only — no Cargo.toml semver constraints touched)

Crate	From → To	Closes
rustls-webpki	0.103.10 → 0.103.13	RUSTSEC-2026-0098 (URI name constraints incorrectly accepted) RUSTSEC-2026-0099 (wildcard cert name constraints accepted) RUSTSEC-2026-0104 (CRL parsing panic)
rand	0.9.2 → 0.9.4	RUSTSEC-2026-0097 (rand unsound with custom logger using rand::rng())

rustls-webpki is purely transitive (iroh-relay / reqwest / quinn / hickory-resolver). rand is a direct dep in forgetty-sync and root Cargo.toml already pinned at \"0.9\" so the patch bump fits within the existing semver constraint.

PR #33 attempted the rand bump to 0.9.3; this consolidates to 0.9.4 (one patch newer) which is the latest within the 0.9.x series. The breaking 0.10.x migration is deferred to a separate task.

.cargo/audit.toml (new file)

Two hickory-proto advisories remain after the bumps. Both are transitive via iroh 0.97.x → iroh-relay → hickory-resolver → hickory-proto 0.25.x — bumping them requires a major iroh bump (deferred). The new file ignores both with rationale comments + clear re-evaluation triggers:

• RUSTSEC-2026-0119 — CPU exhaustion via O(n²) DNS name compression. Fix available in hickory-proto >= 0.26.1; blocked on bumping iroh past 0.97.x. Re-evaluate when an iroh major lands that pulls hickory 0.26+.
• RUSTSEC-2026-0118 — NSEC3 closest-encloser proof unbounded loop. NO upstream fix available as of 2026-05-05 (advisory). Re-evaluate when hickory-dns ships a fix.

Threat model: both vulns require an attacker who can return crafted DNS responses for iroh relay name resolution. Low realistic exposure for solo-dogfood LAN pairing; higher once external users pair devices over untrusted networks. Acceptable risk for v0.1.0-beta with 1 user.

How the fix works

rustsec/audit-check@v2 (the GitHub Action wrapping cargo audit) reads .cargo/audit.toml by default. The [advisories].ignore list suppresses the 2 documented hickory advisories from the failure exit code while still reporting them in the action's log output. The 4 remaining unmaintained-transitive warnings (atomic-polyfill, instant, paste, unicode-segmentation yanked) are warnings, not errors — they don't fail CI.

Tests

Check	Result
cargo check --workspace	✅ PASS
cargo build --release	✅ PASS
cargo test --workspace --exclude forgetty-gtk	✅ PASS — 203 tests (same as pre-bump baseline)
cargo audit (pre-PR)	❌ exit 1 — 5 vulnerabilities, 5 warnings
cargo audit (post-PR)	✅ exit 0 — 0 unignored vulnerabilities, 4 warnings

Audit numbers

Before:
  error: 5 vulnerabilities found!
    RUSTSEC-2026-0098, RUSTSEC-2026-0099, RUSTSEC-2026-0104 (rustls-webpki)
    RUSTSEC-2026-0118, RUSTSEC-2026-0119 (hickory-proto)
  warning: 5 allowed warnings found
    RUSTSEC-2023-0089 (atomic-polyfill, unmaintained)
    RUSTSEC-2024-0384 (instant, unmaintained)
    RUSTSEC-2024-0436 (paste, unmaintained)
    RUSTSEC-2026-0097 (rand, unsound)
    unicode-segmentation 1.13.1 (yanked)

After:
  warning: 4 allowed warnings found
    RUSTSEC-2023-0089, RUSTSEC-2024-0384, RUSTSEC-2024-0436, unicode-segmentation
  (no errors — RUSTSEC-2026-0118 and RUSTSEC-2026-0119 explicitly ignored
   in .cargo/audit.toml with rationale)
  exit code: 0

Follow-ups (filed in docs/harness/BACKLOG.md, not committed)

• CHORE-iroh-bump — bump iroh past 0.97.x to retire the 2 hickory ignores. Wait condition: RUSTSEC-2026-0118 needs upstream fix.
• CHORE-rand-0.10-upgrade — finish the breaking-API migration that PR chore(deps): bump rand from 0.9.2 to 0.10.1 #26 attempted (rand 0.9 → 0.10).
• CHORE-derive-more-bump — retire the unicode-segmentation yanked warning.
• CHORE-unmaintained-warnings-watch — quarterly re-evaluation of atomic-polyfill / instant / paste.
• CHORE-cargo-audit-ci-improvement — shrink .cargo/audit.toml ignores as upstream fixes ship.

Files

.cargo/audit.toml    +30  -0  (new file)
Cargo.lock           +15 -15

Test plan

• cargo check --workspace
• cargo clippy --workspace -- -D warnings
• cargo test --workspace --exclude forgetty-gtk
• cargo build --release
• cargo audit (exits 0)
• CI Security Audit step (will be verified by GitHub Actions on this PR)

🤖 Generated with Claude Code