ci: cargo-audit failing on new 2026 RUSTSEC advisories (blocks merges)

[sorpaas]

The Security audit job in .github/workflows/ci-grey.yml is failing on master since 2026-04-10 because new RUSTSEC advisories have been published against crates in Cargo.lock. This blocks all PR merges (the merge workflow waits for CI).

Failing advisories

Errors (vulnerabilities):

• RUSTSEC-2026-0098 — "Name constraints for URI names were incorrectly accepted" (rustls-webpki or similar)
• RUSTSEC-2026-0099 — "Name constraints were accepted for certificates asserting a wildcard name"

Warnings (currently not failing but worth tracking):

• RUSTSEC-2024-0384 — instant is unmaintained
• RUSTSEC-2024-0436 — paste no longer maintained
• RUSTSEC-2026-0002 — IterMut violates Stacked Borrows
• RUSTSEC-2026-0097 — Rand unsound with custom logger

Current ignore list

.github/workflows/ci-grey.yml currently ignores:

--ignore RUSTSEC-2025-0009 --ignore RUSTSEC-2025-0010

Fix options

1. Update dependencies — bump rustls-webpki, webpki, etc. to patched versions. Preferred, actually fixes the vulnerability.
2. Add ignores — extend --ignore list. Only if the vulnerable code paths are not reached (needs per-advisory justification).

Evidence

Example failing run on PR #721: https://github.com/jarchain/jar/actions/runs/24615098269/job/71975913147

Last successful ci-grey on master: run 24247573136 (2026-04-10).

Why it matters

• All open PRs (test(harness): verify RPC submissions reach block inclusion #719, fix(grey-store): bound count in decode_state_kvs to prevent OOM on corrupt storage #720, ci(grey): add SBOM generation job #721) show Security audit: fail
• genesis-merge.yml waits for CI via gh pr checks --watch --fail-fast, so merges cannot complete even on quorum
• My own PRs (refactor(grey): extract register_block_guarantees and collect_report_hashes helpers #695, test(grey-types): proptest roundtrips for work types #662, fix(grey): remove dead raw EquivocationEvidence broadcast #653) reached quorum repeatedly but never merged for this reason

[johandroid]

Resolved on current master (66d773f). The repository now uses .github/workflows/ci-rust.yml; the vulnerable rustls-webpki versions described here are absent. Verified with cargo-audit 0.22.2 against the current advisory database: 330 dependencies scanned, exit code 0. Only allowed warning RUSTSEC-2026-0097 (rand custom logger) remains.