From 989bc16617d02696e9aee4e8b3dd097142fb4466 Mon Sep 17 00:00:00 2001 From: grumbach Date: Tue, 13 Oct 2026 15:05:50 +0900 Subject: [PATCH] chore(deps): move quinn-proto to 0.11.19 for three RustSec advisories `cargo audit` fails on RUSTSEC-2026-0338, RUSTSEC-2026-0340 and RUSTSEC-2026-0343 against `quinn-proto` 0.11.17. All three are fixed in 0.11.18; this takes 0.11.19, the latest 0.11 release. They reached the RustSec database on 2026-10-12. Since then `main`'s lockfile fails `cargo audit`, and the Security Audit job fails whenever CI runs on a PR that still locks `quinn-proto` 0.11.17. `quinn-proto` is in `Cargo.lock` only. `reqwest`'s `rustls` feature carries the weak feature `quinn?/rustls-aws-lc-rs`, and Cargo records that optional dependency in the lockfile although `http3`, the only `reqwest` feature that enables `quinn`, is off. The unique package lines of `cargo tree --locked --all-features --target all -e normal,build,dev --prefix none --no-dedupe` are the same 606 before and after this change, none of them `quinn-proto`, so no compiled crate changes. Only the `quinn-proto` entry changes. `cargo update -p quinn-proto` also moves `tempfile` from `getrandom` 0.4.3 to 0.3.4, a compiled crate this fix has no reason to touch, so that line is kept as it was. 0.11.17 and 0.11.19 declare the same dependencies, and cargo 1.95, 1.98 and 1.99 accept the lockfile under `--locked` and find nothing to change with `--precise 0.11.19`. --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 6880719e..998f8cf1 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -4646,9 +4646,9 @@ dependencies = [ [[package]] name = "quinn-proto" -version = "0.11.17" +version = "0.11.19" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83" +checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe" dependencies = [ "aws-lc-rs", "bytes",