fix(deps): bump quinn-proto 0.11.15 → 0.11.19 (RUSTSEC-2026-0338..0342) [stack 1/3]

[hyperpolymath]

Summary

Stack 1 of 3: follow-ups to #430 / ECH-05 (#431). This PR fixes the cargo audit failure, which is red on main and on every PR (both the rust-ci / Cargo audit and Cargo Audit / Dependency audit jobs).

The RustSec database added five quinn-proto advisories after main's last green audit on 2026-10-12: RUSTSEC-2026-0338, -0339, -0340, -0341 and -0342, two of them rated 7.5 high. quinn-proto is reached only through reqwest → quinn 0.11.9, an optional HTTP/3 path that the default build doesn't compile, but the audit scans the whole lockfile.

Changes

• Cargo.lock only: quinn-proto 0.11.15 → 0.11.19 via cargo update -p quinn-proto. quinn requires ^0.11.12, so the bump is semver-compatible. It also pulls rand 0.10, getrandom 0.4 and rand_pcg into quinn-proto's subtree only.

RSR Quality Checklist

Required

• Tests pass (no code change; cargo check --locked --workspace --all-targets passes)
• Code is formatted (n/a, lockfile only)
• Linter is clean (n/a)
• No banned language patterns
• No unsafe blocks without // SAFETY: comments
• No banned functions
• SPDX license headers present on all new/modified source files (n/a)
• No secrets, credentials, or .env files included

As Applicable

• New dependencies reviewed for license compatibility: rand_pcg is MIT/Apache-2.0, from the rust-random project like the existing rand
• Others: n/a

Testing

$ cargo audit                     → no vulnerabilities (490 crate dependencies), exit 0
  (before: "error: 5 vulnerabilities found!" on main's lockfile)
$ cargo check --locked --workspace --exclude echidna-rest --all-targets → ok
$ cargo metadata --locked (full workspace, incl. echidna-rest) → ok

echidna-rest was excluded from the local check only because its build script downloads Swagger UI, which this sandbox blocks. CI builds it.

Stack

1. This PR: lockfile bump
2. Hypatia baseline fix: delete the dead ci-templates/mirror.yml, baseline the echidnabot-path SD022 hits, .hypatia-baseline.json → JCS
3. ECH-05 follow-ups: regression fixture → JCS, stage 6 first target, issues row ECH-05: feat(arbitration): consume fidelity evidence, not N re-proofs — type the arbiter's input by alignment certificate and level its verdict #431, norms in .claude/CLAUDE.md

🤖 Generated with Claude Code

https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 945e0673-562c-40bd-a261-612c9015b54b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hyperpolymath]

CI: this PR's fix works. rust-ci / Cargo audit and Cargo Audit / Dependency audit are both green.

The one red check, governance / Validate Hypatia Baseline, is not this PR's. main fails it at 6883126 with the same six findings, which came in with #426 and #427. #433, stacked directly on this PR, fixes it, and I validated that fix with the pinned apply-baseline.sh. I haven't ported the fix down into this PR, to keep the stack split the owner asked for. Once #433 merges after this one, main goes green on the gate. A re-run here would fail identically, since the gate is deterministic for a given tree.

---

Generated by Claude Code

[hyperpolymath]

Codeac analyze results is red: "Codeac was not able to perform analysis". The cause is outside this PR.

• This PR changes only Cargo.lock (quinn-proto 0.11.15 → 0.11.19). Codeac reports no finding, only that its analysis did not run.
• Codeac first posted on this stack at 08:45:36 today, on fix(deps): bump quinn-proto 0.11.15 → 0.11.19 (RUSTSEC-2026-0338..0342) [stack 1/3] #432, chore(hypatia): delete dead ci-templates/mirror.yml, qualify echidnabot paths, baseline → JCS [stack 2/3] #433 and chore(ech05): regression fixture → JCS, stage 6 first target, #431 row, owner norms [stack 3/3] #435 in the same second. The statuses on chore(hypatia): delete dead ci-templates/mirror.yml, qualify echidnabot paths, baseline → JCS [stack 2/3] #433 and chore(ech05): regression fixture → JCS, stage 6 first target, #431 row, owner norms [stack 3/3] #435 link to this PR's Codeac page. That points to a service-side run over the stack, not to anything in a diff. No Codeac status exists on main's last merged PR (feat(arbitration): ECH-05 fidelity evidence and belief/epi/sound verdict levels #430).
• Every GitHub Actions check here is green. That includes rust-ci / Cargo audit (security), which this PR exists to fix.

No fix exists on our side. Codeac is a third-party commit status, and I can't re-run it from this session. Re-triggering it from the Codeac dashboard is the only lever. I'm keeping the PR watched.

---

Generated by Claude Code