Tracking issue for the cargo audit suppressions added in #57.
.cargo/audit.toml ignores two reachable advisories in hickory-proto 0.25.2:
RUSTSEC-2026-0118 — NSEC3 closest-encloser unbounded loopRUSTSEC-2026-0119 — O(n^2) name-compression CPU exhaustion
These are reachable: the node wraps its QUIC transport in the system DNS resolver (crates/gitlawb-node/src/p2p/mod.rs:238), so a malicious DNS response can hit these DoS paths. They are suppressed only because there is no available fix — hickory-proto >=0.26.1 is required, and the latest libp2p-dns on crates.io (0.44) still pins hickory 0.25.
Action: when a libp2p-dns (or libp2p major) release using hickory >=0.26.1 is available, bump it, then remove both RUSTSEC-2026-0118 and RUSTSEC-2026-0119 from .cargo/audit.toml.
Enforcement: the scheduled audit workflow (.github/workflows/audit-schedule.yml) re-runs cargo audit without the ignores weekly and hard-fails if hickory-proto moves off 0.25.x while the ignores remain, so this will not silently outlive the fix.
Tracking issue for the
cargo auditsuppressions added in #57..cargo/audit.tomlignores two reachable advisories inhickory-proto 0.25.2:RUSTSEC-2026-0118— NSEC3 closest-encloser unbounded loopRUSTSEC-2026-0119— O(n^2) name-compression CPU exhaustionThese are reachable: the node wraps its QUIC transport in the system DNS resolver (
crates/gitlawb-node/src/p2p/mod.rs:238), so a malicious DNS response can hit these DoS paths. They are suppressed only because there is no available fix —hickory-proto >=0.26.1is required, and the latestlibp2p-dnson crates.io (0.44) still pins hickory 0.25.Action: when a
libp2p-dns(or libp2p major) release usinghickory >=0.26.1is available, bump it, then remove bothRUSTSEC-2026-0118andRUSTSEC-2026-0119from.cargo/audit.toml.Enforcement: the scheduled audit workflow (
.github/workflows/audit-schedule.yml) re-runscargo auditwithout the ignores weekly and hard-fails ifhickory-protomoves off 0.25.x while the ignores remain, so this will not silently outlive the fix.