From 2dbf3c4e7c0db2230445e6ba64454d8d9db3f9a6 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 14 Oct 2026 08:26:23 +0000
Subject: [PATCH] fix(deps): bump quinn-proto 0.11.15 -> 0.11.19
 (RUSTSEC-2026-0338..0342)

cargo audit (rust-ci and cargo-audit.yml) fails on main since the
RustSec database gained five quinn-proto advisories (two rated 7.5):
stream-reassembly and DATAGRAM buffer-limit bypasses, unbounded CID
retirements, and two remote panics. quinn-proto is reached only through
reqwest -> quinn 0.11.9 (an optional HTTP/3 path), but the audit scans
the whole lockfile. quinn requires ^0.11.12, so this is a lockfile-only,
semver-compatible bump; rand 0.10 / getrandom 0.4 / rand_pcg enter
quinn-proto's subtree only.

Validated: cargo audit -> no vulnerabilities (490 crates);
cargo check --locked --workspace --all-targets (echidna-rest excluded
locally: its build script downloads Swagger UI); cargo metadata --locked
over the full workspace.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
---
 Cargo.lock | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 0bf8ea74..e9c7c7fb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1497,11 +1497,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
- "js-sys",
  "libc",
  "r-efi 5.3.0",
  "wasip2",
- "wasm-bindgen",
 ]
 
 [[package]]
@@ -1511,11 +1509,13 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "r-efi 6.0.0",
  "rand_core 0.10.1",
  "wasip2",
  "wasip3",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -2725,14 +2725,15 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.15"
+version = "0.11.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fcb935c5bec503c2f0e306bdd3e58bb9029dcb14fa8d9ac76e3a5256ac0763e"
+checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe"
 dependencies = [
  "bytes",
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "lru-slab",
- "rand 0.9.4",
+ "rand 0.10.1",
+ "rand_pcg",
  "ring",
  "rustc-hash",
  "rustls",
@@ -2844,6 +2845,15 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
 
+[[package]]
+name = "rand_pcg"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
+dependencies = [
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "rand_xorshift"
 version = "0.4.0"