Triage 10 cargo-audit advisories surfaced by the first real Dependency audit run

[Depo-dev]

Context

The Dependency audit job in security-scan.yml had never actually run. Its dtolnay/rust-toolchain pin resolved to a commit that exists in no ref of that repo, and that action silently skips its steps rather than failing — so the job died later with a misleading sccache: command not found and never reached cargo audit. See #371.

With the toolchain pin fixed in #372, the job ran for the first time and reported 10 advisories across 465 dependencies. These are all pre-existing and were simply invisible until now — nothing in #372 introduced them.

To keep #372 mergeable, cargo audit is set continue-on-error: true there: it reports without blocking. Restore blocking once this backlog is cleared (remove continue-on-error from the cargo audit (Rust workspace) step).

Advisories

ID	Notes
RUSTSEC-2026-0204	crossbeam-epoch — invalid pointer dereference in the fmt::Pointer impl for Atomic/Shared when the underlying pointer is null. Only affects fmt::Display; fmt::Debug is unaffected.
RUSTSEC-2023-0071	Marvin attack — key-recovery timing sidechannel in RSA. Reached transitively; check whether any reachable path performs RSA private-key ops.
RUSTSEC-2026-0049
RUSTSEC-2026-0098	Reported against two separate dependency paths.
RUSTSEC-2026-0099	Reported against two separate dependency paths.
RUSTSEC-2026-0104	Reported against two separate dependency paths.
RUSTSEC-2026-0190
RUSTSEC-2024-0363	Binary protocol misinterpretation in sqlx caused by truncating casts. Directly relevant — the workspace is on sqlx 0.7.
RUSTSEC-2024-0436	paste unmaintained.
RUSTSEC-2025-0119
RUSTSEC-2025-0134	Reported against two separate dependency paths.

Plus: crate spin is yanked.

Suggested approach

1. cargo update for everything that resolves without a semver-major bump; re-run cargo audit to see what is left.
2. For the remainder, decide per advisory whether the vulnerable path is actually reachable from our code — several of these are in transitive deps we never call into on the affected path. Record the reasoning.
3. RUSTSEC-2024-0363 (sqlx) deserves its own look: the workspace pins sqlx 0.7 across four crates, and moving off it is a real upgrade rather than a lockfile bump. Note the CI sqlx-cli version is coupled to this — see the pinning note in ci.yml.
4. Anything genuinely unfixable and unreachable belongs in an ignore list in audit.toml with a written justification and a review date, mirroring the process .trivyignore already documents.
5. Remove continue-on-error from the audit step so the job blocks again.

Related

• dev branch is broken: does not compile, 3 CI gates failing, fabricated Docker/action pins #371 — the broader dev-branch audit this came out of
• fix: repair dev branch compile breaks, two dead action pins, and unbuilt contracts #372 — the PR that made this job run at all