Security: track the 9 open Dependabot advisories (umbrella for #534/#535/#536)

[suchapalaver]

Summary

GitHub reports 9 open Dependabot "Security and quality" advisories. This is an umbrella tracking issue: each advisory already has a dedicated remediation issue, but there was no single place to see the full set and its blocked/unblocked status. The list below is the source of truth; close this when all 9 alerts clear.

All 9 reach us transitively — none are direct dependencies of our crates. Seven root in a single dep (fnox 0.1), two in microsandbox, one in quickjs_runtime.

The 9 alerts

#	Severity	Package (stuck version)	Root dep	Patched in	Tracked by
#4	medium	jsonwebtoken 9.3.1 (Type Confusion → authz bypass)	fnox → google-cloud-auth → google-cloud-kms	10.3.0	#534
#16	low	rustls-webpki 0.101.7 (URI name constraints)	fnox → aws-config → aws-smithy-http-client (rustls 0.21.x)	0.103.12	#534
#17	low	rustls-webpki 0.101.7 (wildcard name constraints)	fnox → aws-config (rustls 0.21.x)	0.103.12	#534
#19	low	rand 0.7.3 (custom-logger unsoundness)	fnox → azure_identity → azure_core → http-types	0.8.6	#534
#25	high	rustls-webpki 0.101.7 (panic on malformed CRL BIT STRING)	fnox → aws-config (rustls 0.21.x)	0.103.13	#534
#6	low	atty 0.2.14 (unaligned read; unmaintained)	fnox (direct)	no fix	#534
#29	high	hickory-proto 0.25.2 (NSEC3 unbounded loop)	microsandbox 0.3.13 → microsandbox-network	no fix on 0.25.x	#535
#30	medium	hickory-proto 0.25.2 (O(n²) name-compression CPU exhaustion)	microsandbox 0.3.13 → microsandbox-network	0.26.1	#535
#1	low	lru 0.14.0 (Stacked Borrows / IterMut)	quickjs_runtime 0.15.7	0.16.3	#536

Remediation status

• deps: bump fnox 0.1 → 1.x to close 5 Dependabot advisories #534 — bump fnox 0.1 → 1.x (closes 6: docs: guide and checklist for adding host tools #4, refactor: deduplicate FalkorDB test container setup #16, ci: prevent 60s recompilation stalls in e2e runner tests #17, test: eliminate per-test FalkorDB container startup overhead #19, Implement a ReAct loop and use provenance history #25, and feat: notion tool mvp #6 if newer fnox drops atty). Currently blocked: the bump clears only rand directly and pulls a libudev dependency via FIDO2; prior attempt (PR chore(deps): resolve secrets via fnox-core 1.x instead of the fnox CLI crate #549) was abandoned. Waiting on upstream, or a decision to replace fnox. This is the highest-leverage fix — 6 of 9 alerts, including the high-severity rustls-webpki CRL panic (Implement a ReAct loop and use provenance history #25).
• deps: bump microsandbox 0.3.13 → 0.4.x to close hickory-proto advisory #30 #535 — bump microsandbox =0.3.13 → 0.4.x (closes Harden A2A/QuickJS stream lifecycle: avoid silent timeouts, preserve in-flight work, and make timeout failures explicit #30; closes single nextest run in CI with JUnit reporting #29 only if 0.4.x pulls hickory-proto ≥ 0.26.x — single nextest run in CI with JUnit reporting #29 has no fix on the 0.25.x line, so verify against the lockfile). Gated behind the sandbox-provider feature; upstream warns of breaking changes between minors.
• deps: bump quickjs_runtime 0.15.7 → 0.17.x to close lru advisory #1 #536 — bump quickjs_runtime 0.15.7 → 0.17.x (closes feat: Implement JSON Schema to BAML type generation with comprehensiv… #1).

Verification

This issue closes when gh api repos/semiotic-agentium/agentium-os/dependabot/alerts --jq '[.[]|select(.state=="open")]|length' returns 0, and the lockfile no longer contains jsonwebtoken 9.3.1, rustls-webpki 0.101.7, rand 0.7.3, atty 0.2.14, hickory-proto 0.25.2, or lru 0.14.0.

Follow-up from #531 (the 16 advisories cargo update alone closed).