[koabula]

cargo audit started failing on main (and so on every PR) after four RustSec advisories were published between 2026-10-22 and 2026-10-30. This makes the supply-chain job pass again: one lockfile upgrade, and three reasoned ignores.

Advisory	Crate	Outcome	Reason
RUSTSEC-2026-0385	ctutils 0.4.2	Upgraded to 0.4.8 (lockfile only)	Semver-compatible; 0.4.4+ has the fix. Reached via digest 0.11 in the hpke-rs provider.
RUSTSEC-2026-0387	crypto-bigint 0.5.5	Ignored	No upgrade path: it comes from elliptic-curve 0.13 (p256/p384/k256), and openmls_rust_crypto / openmls_basic_credential still require p256 0.13 in their newest release (0.6.0). TapChat's only MLS suite is MLS_128_DHKEMX25519_AES128GCM_SHA256_Ed25519: device key Ed25519, HPKE on X25519, neither of which uses crypto-bigint. openmls rejects a Welcome in another suite before opening the group secrets (creation.rs, CiphersuiteMismatch). So the NIST-curve code runs only when KeyPackage::validate() checks a peer KeyPackage's signature on public inputs, and then verify_key_package_is_peer_device() rejects it.
RUSTSEC-2026-0459	libsqlite3-sys 0.30.1	Ignored	TapChat builds bundled-sqlcipher-vendored-openssl. The "patched" libsqlite3-sys 0.39.x (rusqlite 0.41) still builds that feature from sqlcipher-src =419.0.6, which bundles the affected SQLite 3.53.4, so a rusqlite 0.32 → 0.41 major bump would silence the audit without fixing the build. The bug needs a database plus -wal written by a less trusted party. TapChat opens only its own state.db in the profile it unlocks and has no database import.
RUSTSEC-2026-0429	zip 4.6.1	Ignored	The earlier zip reasoning (Unix permission bits) does not carry over: this is an abort in ZipArchive::extract() that also happens on Windows, and tauri-plugin-updater's Windows extract_zip does call extract(). It does so only on bytes that download() has already signature-verified, and TapChat's Windows updater artifacts are the signed .msi / -setup.exe themselves (createUpdaterArtifacts: true; release.yml publishes only those), so no genuine update takes the zip branch.

Other changes:

• deny.toml: cargo-deny does not read .cargo/audit.toml. Its graph is the root package, which builds tapchat-desktop without gui, so it contains crypto-bigint and libsqlite3-sys but not zip, quick-xml or rkyv. Only those two IDs are added there, each with a reason.
• Zip comment: the existing comment said the updater "still requires zip ^4". That is no longer true: tauri-plugin-updater 2.14.1 (2026-10-28) moved to zip ^9, but it also needs tauri ^2.12 (locked: 2.10.3) and Rust 1.90. The comment now says so. All four zip entries can go once the lockfile takes updater ≥ 2.14.1, which is a follow-up.
• Hand-edited lockfile: there is no Rust toolchain on the machine this was written on. The Cargo.lock change (ctutils version and checksum) was copied from the crates.io index; ctutils 0.4.8 needs cmov ^0.5.4, which is already locked. This PR's CI is the verification.

Not changed: the yanked async-executor 1.14.0 and clipboard-win 5.4.1 that cargo audit warns about. Both come only through gui-feature Tauri plugins, so they are warnings and outside cargo-deny's graph.

🤖 Generated with Claude Code