Fix 28 cargo-audit advisories on transitive deps

[EVWorth]

File created at: /tmp/issue-body.md
EOF
ISSUE_BODY

Context

PR #188 attempted to fix CI's cargo-audit job by pinning 28 RUSTSEC advisories with --ignore flags. That was hiding the issues, not fixing them. #188 was closed; the cargo-audit job was removed from PR CI in #203.

This issue tracks the actual fix: get cargo audit to pass cleanly, with no --ignore flags, then re-add the job to PR CI.

Advisories (28 total)

tauri/gtk-rs ecosystem (unmaintained + unsafe)

• glib 0.18.5: RUSTSEC-2024-0429 (unsound, VariantStrIter)
• rand 0.7.3: RUSTSEC-2026-0097 (unsound, custom logger)
• spin 0.9.8: yanked
• unic-ucd-version: RUSTSEC-2025-0098 (unmaintained)
• atk, atk-sys: RUSTSEC-2024-0413 (unmaintained, gtk-rs GTK3)
• gdk, gdk-sys, gdkwayland-sys, gdkx11, gdkx11-sys, gtk, gtk-sys, gtk3-macros: unmaintained gtk-rs chain
• proc-macro-error, fxhash, paste: sub-deps of above

sqlx

• sqlx: RUSTSEC-2024-0363 (binary protocol cast)

rustls

• rustls-webpki: RUSTSEC-2026-0098 (URI name constraints)
• rustls-webpki: RUSTSEC-2026-0099 (wildcard in name constraints)
• rustls-webpki: RUSTSEC-2026-0104 (reachable panic in CRL parsing)
• rustls-pemfile: RUSTSEC-2025-0057
• rsa: RUSTSEC-2023-0071 (Marvin Attack timing sidechannel)

XML / async / other

• quick-xml: RUSTSEC-2026-0194 (quadratic runtime in start tag check)
• quick-xml: RUSTSEC-2026-0195 (unbounded namespace allocation DoS)
• crossbeam-epoch: RUSTSEC-2026-0204 (invalid pointer deref in fmt::Pointer)

mas-* sub-deps (transitive)

RUSTSEC-2024-0370, 2024-0411, 2024-0412, 2024-0414, 2024-0415, 2024-0416, 2024-0417, 2024-0418, 2024-0419, 2024-0420, 2024-0436, 2025-0075, 2025-0080, 2025-0081, 2025-0100, 2025-0134

(Sub-deps of the above — most should resolve when parents are bumped.)

Fix strategy (recommended)

Phase 1: Bump parent crates (resolves most)

1. Bump tauri to latest 2.x — should pull in newer glib, gtk-rs versions, possibly newer sqlx
2. Bump sqlx — should resolve RUSTSEC-2024-0363
3. Bump rustls + rustls-webpki — resolves 3+ advisories
4. Bump quick-xml — resolves 2 advisories (verify whether tauri/sqlx already include this)
5. Bump crossbeam-epoch — resolves 1 advisory

Phase 2: Replace unmaintained gtk-rs (harder)

The atk/gdk/gtk chain is unmaintained (RUSTSEC-2024-0413). Options:

• Migrate to GTK4 bindings (gtk4-rs is a separate effort)
• Replace webview backend (Tauri's webkit2gtk → something else)
• Pin to a fork that maintains the GTK3 bindings

This is the hardest part. May not be feasible in the near term.

Phase 3: Re-add cargo-audit to PR CI

Once cargo audit exits 0 with no --ignore flags, re-add the job to .github/workflows/ci.yml (with needs: detect-changes + if: needs.detect-changes.outputs.cargo == 'true' like the other jobs).

Acceptance criteria

• cargo audit exits 0 with zero --ignore flags
• All previously-listed advisories resolved (either by parent bump or upstream fix)
• New advisories fail CI (gate is live)
• cargo-audit job restored to .github/workflows/ci.yml
• All sub-tasks closed

Related

• ci: pin known cargo-audit advisories #188 (closed) — the --ignore workaround, superseded
• ci: skip heavy jobs when only docs/workflows/config change #203 (open) — path filters + cargo-audit removal
• This issue blocks restoring cargo-audit to PR CI
  EOF