security: 4 CVE advisories in Cargo.lock (bridge triage, Track E)

[hyperpolymath]

panic-attack estate sweep — Track E bridge triage

panic-attack bridge triage (RustSec advisory DB, with reachability analysis) found 4 CVE/advisory findings in this repo's Cargo.lock (out of 213 total dependencies; 4 vulnerable).

Severity: medium: 4
Reachability: reachable: 4
Classification: unmitigable: 4

Each finding includes a recommended action (often Remove unused dependency for phantom-imported crates). Reachability phantom = declared in Cargo.toml but never imported in any .rs file — removing the dep eliminates the CVE entirely with no behavioural change.

Estate tracker: hyperpolymath/panic-attack#32.

Findings

full advisory list

GHSA-3v94-mw7p-v465  hickory-proto@0.25.2  medium  reach=reachable  class=unmitigable  fix=
GHSA-q2qq-hmj6-3wpp  hickory-proto@0.25.2  medium  reach=reachable  class=unmitigable  fix=
RUSTSEC-2026-0118  hickory-proto@0.25.2  medium  reach=reachable  class=unmitigable  fix=
RUSTSEC-2026-0119  hickory-proto@0.25.2  medium  reach=reachable  class=unmitigable  fix=

---

🤖 Discovered during the panic-attack estate sweep (2026-05-26) — Track E (bridge triage). See hyperpolymath/panic-attack#32 for campaign tracker.

[hyperpolymath]

Track E (Batch B) triage: skipping phantom-strip PR — all 4 advisories are against hickory-proto@0.25.2 which is reach=reachable / class=unmitigable in the source bridge report. Phantom-strip workflow is not applicable here (the crate is genuinely imported and the CVE cannot be eliminated by dropping the declaration). Closing this issue requires either (a) a hickory-proto major-version bump to an unaffected release, or (b) a verified mitigation downstream of the call site — both out of scope for the mechanical Batch B sweep. Re-route to Track E remediation (non-phantom) cohort.