docs(security): record glib VariantStrIter constraint (Dependabot #18)

[CompleteDotTech]

Outcome: not fixable by a version bump

Dependabot alert #18 (moderate, GHSA-wrw7-89jp-8q8g) wants glib >= 0.20.0. src-tauri/Cargo.lock resolves glib 0.18.5, and 0.20.0 is unreachable from this dependency graph. There is no lockfile change to make, so this PR ships the derivation instead of a fabricated bump. Cargo.lock is untouched.

The constraint

glib is not in src-tauri/Cargo.toml. It arrives through the Linux/BSD GTK3 stack behind tauri and wry:

$ cd src-tauri && cargo tree -i glib --target x86_64-unknown-linux-gnu
glib v0.18.5
├── atk v0.18.2 → gtk v0.18.2 → { libappindicator → tray-icon → tauri v2.11.2,
│                                 muda, tao → tauri-runtime-wry,
│                                 webkit2gtk v2.0.2 → wry v0.55.1 }
├── cairo-rs, gdk, gdk-pixbuf, gdkx11, gio, gtk, javascriptcore-rs,
    libappindicator, pango, soup3, webkit2gtk

cargo update -p glib reports Locking 0 packages — 0.18.5 is already the newest in ^0.18. Forcing the patched version names the pin:

$ cargo update -p glib --precise 0.20.0
error: failed to select a version for the requirement `glib = "^0.18"`
candidate versions found which didn't match: 0.20.0
required by package `gtk v0.18.2`
    ... which satisfies dependency `gtk = "^0.18"` (locked to 0.18.2) of package `tauri v2.11.2`

Upgrading Tauri would not help

The pin is the GTK3 binding generation, not our Tauri version:

• gtk tops out at 0.18.2 (2024-12-09) — the highest version that crate has ever had. glib 0.20 belongs to gtk4-rs; no GTK3 binding release consumes it.
• webkit2gtk 2.0.2 (newest, and pinned =2.0.2 by wry) requires glib ^0.18.0 / gtk ^0.18.0 / gio ^0.18.0.
• tauri 2.11.5 (latest) and wry 0.56.1 still declare gtk ^0.18 for cfg(any(target_os = "linux", …bsd)).

So no Tauri v2 release resolves glib above the 0.18 line on Linux. Per the task scope, no major Tauri work was attempted — and it would not have mattered.

Exposure: none identified

• Linux/BSD only. The GTK stack is cfg-gated off macOS and Windows. The Linux artifact is real, though — release.yml builds an AppImage on ubuntu-22.04 — so this narrows the blast radius rather than eliminating it.
• No reachable call site. VariantStrIter is only constructed by glib::Variant::iter_str(). Grepping the vendored sources of all 19 crates in the tree that depend on glib finds iter_str/VariantStrIter in glib-0.18.5 itself and nowhere else — not in gtk, gdk, gdkx11, gdk-pixbuf, gio, atk, cairo-rs, pango, soup3, javascriptcore-rs, webkit2gtk, libappindicator, muda, tray-icon, tao, wry, tauri, tauri-runtime, or tauri-runtime-wry. src-tauri/src uses no glib, gio, or Variant API of its own.
• Failure mode is a crash. Per the advisory, the unsound write is discarded under optimization and CStr::from_ptr then dereferences NULL — a null-pointer crash, not a disclosure or execution primitive.

What would lift it

Either wry moving its Linux webview off GTK3 (visible as a change to its webkit2gtk =2.0.2 pin, which would bring glib 0.20+), or an upstream backport to the unmaintained glib 0.18 line. Neither is actionable here. The doc records the re-check commands.

The artifact

docs/dependency-advisories.md is deliberately general, not glib-specific: a frozen GTK3 stack will produce more alerts with no available fix, and each one currently costs a session the same derivation. Each entry records the resolver refusal verbatim, the commands that reproduce it, the exposure assessment, and the upstream condition that retires it. Entries are deleted when their alert closes — the alert stays the source of truth for state.

The repo has no deny.toml, no audit.toml, and no .github/dependabot.yml, so there was no existing suppression convention to extend. docs/README.md is updated under Living → Integrity and integrations, per that index's own "add its line to the right section" rule.

Validation

• node scripts/docs-index.test.mjs → index ok (49 documents classified, 62 links resolved). This is the check CI runs on the docs path.
• cd src-tauri && cargo check --locked → exit 0 in 1m25s (9 pre-existing dead-code warnings, unrelated). This confirms the lockfile still resolves; it does not compile the GTK stack, since this is a Windows machine and that code is cfg-gated out. The Linux path is only exercised in CI/release.
• pnpm lint was not run: its scripts only cover src/** TypeScript, and this change touches no source.

Closes nothing — alert #18 stays open by design. Tracked as cave-13m.