From bd4a0ed467c10e6ae2ca3defb60d0a18dd1ea965 Mon Sep 17 00:00:00 2001
From: Justin Davis <juzzydee@gmail.com>
Date: Mon, 18 May 2026 10:13:19 +1000
Subject: [PATCH] chore(deps): lockfile patches for open security advisories
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Patches four open dependabot alerts on master:

  | Severity | Package      | From → To       | Advisory                              |
  |----------|--------------|-----------------|---------------------------------------|
  | HIGH     | aws-lc-sys   | 0.38.0 → 0.41.0 | CRL Distribution Point logic error    |
  | HIGH     | aws-lc-sys   | 0.38.0 → 0.41.0 | X.509 Name Constraints bypass         |
  | low      | rand         | 0.9.2  → 0.9.4  | Unsound with custom logger            |
  | low      | rand         | 0.10.0 → 0.10.1 | Same advisory (transitive 0.10)       |

Lockfile-only. No Cargo.toml or source changes. All four packages are
transitive — we don't import aws-lc-sys directly (it comes in via
rustls → aws-lc-rs), and rand comes in directly only at the 0.9 line;
0.10 is transitive.

The aws-lc-sys patch line is 0.39.0 but aws-lc-rs 1.16 pins to ^0.38,
so the bump required pulling aws-lc-rs forward to 1.17 first. End state
(0.41.0) is past the patch line.

Both aws-lc-sys advisories are in the native rustls TLS path — the
wasm32 worker build doesn't pull either crate. Concrete exposure for
both is theoretical (CRL parsing and URI/wildcard name validation are
both branches we don't exercise), but they're flagged HIGH and the fix
is a lockfile-only no-op, so taking it.

49/49 tests pass. wasm32 lib build clean.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 Cargo.lock | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 30d8278..1ae7a97 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -81,9 +81,9 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.16.1"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94bffc006df10ac2a68c83692d734a465f8ee6c5b384d8545a636f81d858f4bf"
+checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00"
 dependencies = [
  "aws-lc-sys",
  "zeroize",
@@ -91,9 +91,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.38.0"
+version = "0.41.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4321e568ed89bb5a7d291a7f37997c2c0df89809d7b6d12062c81ddb54aa782e"
+checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4"
 dependencies = [
  "cc",
  "cmake",
@@ -1026,7 +1026,7 @@ dependencies = [
  "hyper-util",
  "image",
  "js-sys",
- "rand 0.9.2",
+ "rand 0.9.4",
  "rmcp",
  "rusqlite",
  "rustls",
@@ -1286,9 +1286,9 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
 [[package]]
 name = "rand"
-version = "0.9.2"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
 dependencies = [
  "rand_chacha",
  "rand_core 0.9.5",
@@ -1296,9 +1296,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc266eb313df6c5c09c1c7b1fbe2510961e5bcd3add930c1e31f7ed9da0feff8"
+checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
 dependencies = [
  "chacha20",
  "getrandom 0.4.2",
@@ -1412,7 +1412,7 @@ dependencies = [
  "http-body-util",
  "pastey",
  "pin-project-lite",
- "rand 0.10.0",
+ "rand 0.10.1",
  "rmcp-macros",
  "schemars 1.2.1",
  "serde",