From 52193cc83eb7bb8acb0550ff0148df737f135d14 Mon Sep 17 00:00:00 2001
From: Interchouette <484423+Interchouette@users.noreply.github.com>
Date: Sat, 17 Oct 2026 18:03:20 +0200
Subject: [PATCH 1/3] chore(deps): bump rustls to 0.23.46

Clear cargo-audit advisories RUSTSEC-2026-0346 through 0349.
Also bump quinn-proto when the lock still pulled a vulnerable line.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 Cargo.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index c291a58..f3ec0d9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1854,7 +1854,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -5814,9 +5814,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.17"
+version = "0.11.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83"
+checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe"
 dependencies = [
  "bytes",
  "getrandom 0.4.3",
@@ -5845,7 +5845,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -6486,14 +6486,14 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "rustls"
-version = "0.23.45"
+version = "0.23.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
 dependencies = [
  "once_cell",
  "ring",
@@ -7418,10 +7418,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
  "once_cell",
  "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]

From 715f3a0c69477653b44cf1f373165ada22288886 Mon Sep 17 00:00:00 2001
From: Interchouette <484423+Interchouette@users.noreply.github.com>
Date: Sat, 17 Oct 2026 18:15:32 +0200
Subject: [PATCH 2/3] fix(ci): ignore ruzstd advisory until aya bumps object

object 0.36 (aya) pins ruzstd ^0.7; fixed line needs object >=0.40.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 Makefile | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 9c03cf7..bf5bcaf 100644
--- a/Makefile
+++ b/Makefile
@@ -114,8 +114,10 @@ geiger:
 	done
 
 ## Requires `cargo install cargo-audit`.
+## RUSTSEC-2026-0344: ruzstd via object 0.36 / aya; object >=0.40 needs aya bump.
 audit:
-	$(CARGO) audit
+	$(CARGO) audit \
+		--ignore RUSTSEC-2026-0344
 
 ## Requires `cargo install cargo-deny`.
 deny:

From cc5271fb80e07045a6670ae25063fcc2019ce5f3 Mon Sep 17 00:00:00 2001
From: Interchouette <484423+Interchouette@users.noreply.github.com>
Date: Sat, 17 Oct 2026 18:17:39 +0200
Subject: [PATCH 3/3] chore(deps): ignore ruzstd advisory in cargo-deny

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 deny.toml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/deny.toml b/deny.toml
index d9e07de..dc1bad5 100644
--- a/deny.toml
+++ b/deny.toml
@@ -8,6 +8,10 @@ all-features = false
 yanked = "warn"
 # Fail only if a direct workspace crate is unmaintained (GPUI pulls several).
 unmaintained = "workspace"
+ignore = [
+    # object 0.36 / aya-obj pin ruzstd 0.7; fixed line is ruzstd >= 0.9.1.
+    { id = "RUSTSEC-2026-0344", reason = "ruzstd 0.7 via object/aya-obj; no safe upgrade until aya bumps object" },
+]
 
 [licenses]
 unused-allowed-license = "allow"