[loonghao]

Summary

Apply four compatible patch updates to the committed Cargo.lock, without regenerating the lockfile or changing package manifests:

• crossbeam-epoch 0.9.18 → 0.9.21: RUSTSEC-2026-0204.
• h2 0.4.14 → 0.4.20: RUSTSEC-2026-0258.
• memmap2 0.9.10 → 0.9.11: unsoundness advisory RUSTSEC-2026-0186.
• chacha20 0.10.0 → 0.10.2: replace a yanked release.

The entire diff is 16 lines: four version/checksum pairs. Every other package field and dependency edge is unchanged, including the existing Windows bindings. Checksums are Cargo-generated and independently matched against the official crates.io index; all four selected versions are not yanked.

Verification

• Original base: main 5a85987d9c77a73a0e67f9141d1df19a5ad8ac06. Now rebased onto ed367264c6c91c3c565b2815881aec3cb2c0c482 after fix(archive): validate 7z entry paths before extraction #1226 merged; current head 82114f3b9cb5613fef4f2fab70c3a80c740c0e25. The same 16-line Cargo.lock-only diff is preserved.
• Full Linux vx cargo metadata --locked --offline --format-version 1 --filter-platform x86_64-unknown-linux-gnu: passed; Cargo.lock was not modified.
• vx git diff --check: passed.
• Local Windows/macOS metadata could not complete offline because their platform source crates were not cached; no cross-platform success is claimed. Native compilation and runtime compatibility are pending hosted CI.
• No local compilation was performed.
• Candidate lock SHA-256: dff420534c64eba856804ad49036002e8215bc87c1202ca9391206b3cfeeca2b.

Audit result and remaining work

Both exact committed baseline and candidate locks were audited without regeneration using cargo-audit 0.22.2, the same RustSec database commit edb58f5974b83eb8302332821cb6d389777aa351, and --no-fetch --deny warnings --format json.

• Baseline: 10 vulnerabilities + 10 denied warnings, exit 1.
• Candidate: 8 vulnerabilities + 8 denied warnings, exit 1.
• Remaining vulnerabilities: two hickory-proto advisories, five quinn-proto advisories, and one sevenz-rust advisory.
• Remaining warnings: six unmaintained packages, one lru unsoundness advisory, and the yanked zip release.

This is a bounded improvement, not a clean security audit. Existing CI audit recipes swallow command failures and may try to regenerate the lockfile; their green status is not evidence of an audit pass. Correct failure propagation and remaining dependency migrations need separate work. No advisory exclusions, audit settings, workflow permissions, or release settings are changed.

Related archive path hardening and integration test repairs remain in #1226. This PR is intentionally separate and stays draft until independent review and exact-head CI verification.

Original-branch CI and rebased validation

• Independent review read the final 16-line diff and the checksum/dependency-field evidence; no blocking findings.
• Original head a68dfa1252c67423395e89113839b526ceddd1c9 completed 36 successful checks and 18 conditional skips. Linux, Windows, macOS x86_64, and macOS ARM64 release builds each compiled the four patched versions successfully, with no lock reselection reported.
• Linux full tests: 4289 passed, 128 existing skips, zero retry-absorbed failures. macOS full tests: 4292 passed, 128 existing skips, zero retry-absorbed failures.
• Windows full tests: 4313 passed, 130 existing skips, one retry-absorbed failure in the old host-dependent ImageMagick alias assertion. This is not treated as clean acceptance. fix(archive): validate 7z entry paths before extraction #1226 has now merged the isolated fixture and native-path correction; this branch was rebased to inherit that fix rather than rerunning the old test unchanged.
• The original branch also inherited main's one-line syn 3 hakari feature drift; its warning-only PR check is not claimed as clean. fix(archive): validate 7z entry paths before extraction #1226 fixed that generated line, and main's postmerge Code Quality log confirms no changes detected/no operations to perform.
• Exact rebased-head native validation is now complete; see the verified 2026-10-17 evidence below.

Rebased validation verified on 2026-10-17

• Head remains 82114f3b9cb5613fef4f2fab70c3a80c740c0e25; base remains ed367264c6c91c3c565b2815881aec3cb2c0c482. The CI checkout is GitHub's test merge 33b9ebd675a2b6f0361a27b2a20be9cf6d4cb288; it has the identical Git tree 5e2df5fe80d4119aa1d373a8026cc2e3ae007cbf as the PR head, verified from both commit objects.
• Rebased CI run completed successfully. Raw full-test logs confirm Linux 4,289 passed / 128 skipped, macOS 4,292 passed / 128 skipped, and Windows 4,313 passed / 130 skipped. Each platform's generated flaky-test report explicitly records 0 failures absorbed by retries.
• Exact jobs: Linux, macOS, Windows.
• All four native release builds, ARM64 GNU cross-check, three native extended-format installer jobs, Lockfile Drift, and the other seven associated workflows completed successfully.
• Code Quality log confirms hakari reported no operations to perform, and formatting, Clippy and Rust documentation completed. Its existing advisory inline-test check still prints a failure that the workflow suppresses; this is not represented as a strict all-quality-gates pass.
• Security Audit log still reports 8 vulnerabilities and 8 denied warnings. It also logs failed lock regeneration because every compatible zip ^8.1 release is yanked. Both failures are swallowed by the existing recipe, so the green job is not a clean audit.

The prior pending native-test and generated-hakari checks are now resolved. This PR remains Draft; remaining dependency migrations and truthful audit failure propagation are separate work. No merge, release, permission change or advisory exclusion was performed.

Strict audit of merged main — 2026-10-17 08:03 UTC

The compatible lock patches in #1227 are now merged as 0388b75a24f28b376c5372c95a4d064ffdd581df. A separate read-only audit of that exact committed lock reports 11 vulnerabilities and 7 denied warnings, with exit code 1.

• Tool: official cargo-audit 0.22.2 release, Linux musl archive SHA256 7fb9497f8594b389e5fce5ef9b92db08432996895b2e0c5a0167a69ed445c428, verified before execution.
• Lock identity: 573 dependencies, Git blob bffb70410116a0e4dc754fcbe32559bc009c8e40, SHA256 dff420534c64eba856804ad49036002e8215bc87c1202ca9391206b3cfeeca2b. The blob matches merged main and its bytes were unchanged after both JSON and terminal audits.
• Command: cargo-audit audit --deny warnings --file Cargo.lock --db advisory-db --json; terminal confirmation used the same database with --no-fetch. No ignore, target filtering, lock regeneration or dependency update was used.
• Advisory DB: 64f92cdc64401fab47baa10e2e11fe382aa57155, 1334 advisories.
• Remaining vulnerability reports: quinn-proto 0.11.14 (5), hickory-proto 0.25.2 (2), zip 8.6.0 (3), sevenz-rust 0.6.1 (1). Denied warnings: 6 unmaintained packages and lru 0.16.4 unsoundness. This is package-level advisory evidence, not a full application reachability assessment.
• The automatic main audit instead regenerated a temporary lock containing 578 dependencies and swallowed a 6-vulnerability/7-warning failure. That result does not describe the committed 573-dependency lock and is not a clean audit.

Dependency remediation remains outstanding. The audit-gate fix in #1228 remains Draft and blocked by its failed required CI Success check; no protection or permission changes, bypass, or merge of #1228 was performed.