fix(security): resolve all Dependabot advisories and audit gaps

[doublegate]

Important

Breaking: MSRV rises 1.85 → 1.88.

This is forced, not incidental. RUSTSEC-2026-0009 is a DoS via stack exhaustion in time, which ProRT-IP reaches through x509-parser when parsing certificates from scanned hosts — attacker-influenced input, so genuinely reachable. Every time release that fixes it (0.3.47 through 0.3.55) declares rust-version = "1.88.0"; there is no version both patched and buildable on 1.85. Holding the old floor meant shipping the advisory.

I confirmed this wasn't just dependency drift: a targeted update of only the advisory-affected crates, leaving time alone, holds the graph at exactly main's MSRV baseline. The floor moves for this one advisory.

It also fixes a pre-existing violation — home 0.5.12 already required 1.88 and was quietly breaking the 1.85 promise on main. Verified afterwards: 499 packages resolved, 0 require > 1.88.

Updated in Cargo.toml, the README badge and requirements, WARP.md, CONTRIBUTING.md, the PR-template checklist, and the CI job.

Encapsulates the outstanding Dependabot PR (bytes 1.11.0 → 1.11.1) and remediates every RustSec advisory affecting a crate this project compiles.

	Before	After
cargo audit (workspace)	9 vulnerabilities, 10 warnings	exit 0
cargo audit (fuzz/)	7 vulnerabilities — never audited	exit 0
cargo deny check	licences failing	exit 0 (advisories, licenses, bans, sources)
cargo test --workspace	2,563 passed	2,581 passed, 0 failed

Fixed by dependency updates alone

All semver-compatible; no manifest edits needed.

Crate	Advisory
bytes → ≥1.11.1	RUSTSEC-2026-0007 — integer overflow in BytesMut::reserve
crossbeam-epoch → ≥0.9.20	RUSTSEC-2026-0204
rkyv → ≥0.8.17	RUSTSEC-2026-0233/0234/0235 — use-after-free and OOB reads deserialising crafted archives
time → ≥0.3.47	RUSTSEC-2026-0009 — DoS via stack exhaustion (drives the MSRV raise)
memmap2 ≥0.9.11, anyhow ≥1.0.103, rand ≥0.8.6, event-listener	unsoundness warnings

Two dependencies were declared but never imported

The two highest-severity advisories in this project came from a crate that contributed nothing to it.

• quick-xml removed — RUSTSEC-2026-0194 and RUSTSEC-2026-0195, both 7.5 high (quadratic parse time on duplicate attribute names; unbounded namespace-declaration allocation). It appeared only in crates/prtip-cli/Cargo.toml; no source file imports it. ProRT-IP writes its Nmap-compatible XML by hand.
• tui-input removed — likewise never imported, and the sole reason a second ratatui (0.28.1) was being built alongside 0.29.0.

Upgrades that clear the remaining warnings

• ratatui 0.29 → 0.30 drops paste (RUSTSEC-2024-0436) and moves to lru ≥0.18.2, fixing RUSTSEC-2026-0002 and RUSTSEC-2026-0253. Needs Rust 1.88, which the time fix already required. I checked the 0.30 breaking-change surface against this codebase before committing to it — Alignment rename, block::Title/Position, highlight_symbol, WidgetRef, custom Backend impls, Styled, braille symbols — and ProRT-IP uses none of it. Zero code edits.
• indicatif 0.17 → 0.18 replaces number_prefix (RUSTSEC-2025-0119) with unit-prefix. crates/prtip-scanner had pinned its own indicatif = "0.17" outside the workspace table and was building a second copy.
• console 0.15 → 0.16, crossterm 0.28 → 0.29 to deduplicate crates left doubled by the above.

The fuzz crate was never audited

It is excluded from the workspace and keeps its own Cargo.lock, so neither cargo deny nor a workspace cargo audit ever read it. It carried three rustls-webpki advisories that do not appear in the root at all — RUSTSEC-2026-0098/0099 (name constraints wrongly accepted for URI names and wildcard-asserting certificates) and RUSTSEC-2026-0104 (reachable panic parsing CRLs) — plus bytes, crossbeam-epoch and time. Fixed, and CI now audits that lockfile.

rsa: exempted, not fixed

RUSTSEC-2023-0071 (Marvin Attack) has no fixed version. rsa is never compiled — it reaches the lockfile only via sqlx-mysql, an optional dependency of sqlx, and this workspace enables only ["runtime-tokio", "sqlite", "chrono"]. Cargo records optional dependencies whether or not their feature is on.

Verified rather than argued:

cargo tree -i rsa        --workspace --target all  -> nothing to print
cargo tree -i sqlx-mysql --workspace --target all  -> nothing to print

deny.toml ends with no advisory exemptions at all. The rsa exemption lives in .cargo/audit.toml (mirrored in fuzz/.cargo/) with the condition under which it must be withdrawn. It is deliberately not in deny.toml: cargo-deny resolves the feature-aware graph and never encounters rsa, so an entry there would only emit advisory-not-detected — and would mask the advisory if a future change made rsa genuinely reachable.

A real bug found while removing quick-xml

Removing an XML library from a project that hand-writes XML meant auditing what it hand-writes.

crates/prtip-cli/src/output.rs escaped the banner but interpolated result.service straight into name="...". Both are chosen by the host being scanned, so a hostile target could close the attribute and inject elements into a scan report — a forgery against whatever consumes it. export.rs escaped both correctly, which is precisely the inconsistency two hand-rolled copies invite.

Both now share one implementation in crates/prtip-cli/src/xml.rs, hardened beyond the five metacharacters: XML 1.0 forbids most control characters even as numeric references, so a banner containing a NUL — unremarkable from a binary protocol — previously produced a document conforming parsers reject. Those are now rendered as visible \xNN, matching how Nmap presents non-printable banner bytes, so evidence survives and the document stays valid.

Nine tests, including a negative control that walks every byte value asserting no illegal code point survives, and an attribute-breakout attempt.

Keeping it fixed

• .github/dependabot.yml added. There was no Dependabot config at all, so the repository received only the security PRs GitHub opens unprompted; routine version updates were never proposed. That is how a quick-xml five minor versions behind and a duplicate ratatui major went unnoticed. Updates are grouped — minor/patch batched, majors separate, security together — because ungrouped updates on a workspace this size produce enough PRs to be ignored, which is indistinguishable from having none. Covers cargo (root and fuzz), GitHub Actions, and docker/.
• CI runs all four cargo-deny checks, not just advisories. The licence check had never run: deny.toml still allowed the deprecated GPL-3.0 identifier while the workspace now declares GPL-3.0-or-later, so cargo deny check licenses was failing and CI could not have caught it.
• .gitignore fixed so audit.toml is tracked. .cargo/ was excluded wholesale, which silently dropped both exemption files from the first staging attempt and would have failed CI's fuzz audit. The pattern has to be .cargo/* plus a !.cargo/audit.toml negation — git does not descend into an excluded directory, so a negation under .cargo/ is never consulted.
• Stale deny.toml ignores for paste and number_prefix removed; both crates are gone from the tree.

Documentation link checking, fixed properly

The link check failed three consecutive runs on three different external hosts — a 429 from docs.ansible.com, then a connection failure to bgp.tools — while seven genuinely broken internal links sat undetected behind them. Fixing external symptoms one at a time was never going to converge, because they weren't defects in the repository.

The seven broken links are in to-dos/PHASE-5/SPRINT-5.5.{5,6}-TODO.md, pointing at ../docs/... and ../benchmarks/... from to-dos/PHASE-5/ — one directory short. All four targets exist; they now use ../../. They were never reported because the to-dos/ step ended with || true, discarding every failure in that directory.

Merges no longer depend on third-party uptime. Pull requests and pushes check internal links only (relative paths, heading anchors) — deterministic, always the author's to fix. The weekly schedule and manual dispatches check external links too, so link rot is still caught without blocking anyone. Verified across all 232 markdown files: zero broken internal links. PR runs also dropped from 4m38s to 1m20s.

Three further ways this check was lying:

• mlc_config.json was inert — the workflow generated its own config over the top, so editing the committed file did nothing. It's now the single source of truth, with only the PR-mode ignore layered on.
• The summary always claimed success — it ran with if: always() and unconditionally printed "✅ All markdown links validated successfully", including on failed runs.
• The first broken link hid the rest — the loop exited at the first failure. It now checks every file and reports how many failed.

Note on the superseded PR

The one open Dependabot PR (bytes 1.11.0 → 1.11.1) lives on doublegate/ProRT-IP_NPSL, which is now private and archived, so it cannot be merged or closed there. Its content is included here.

Verification

cargo audit                                              exit 0   (workspace)
cargo audit  (in fuzz/)                                  exit 0
cargo deny check                                         exit 0   all four checks
cargo fmt --all -- --check                               exit 0
cargo clippy --workspace --all-targets -- -D warnings    exit 0
cargo test --workspace          2,581 passed, 0 failed, 121 ignored

Test count 2,563 → 2,581: the +18 is the 9 new xml.rs tests, which prtip-cli compiles into both its lib and its bin.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NBDCJvLbq7nuor7RtT57rD

[github-actions]

🤖 Hi @doublegate, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 549ca136-726d-4208-9904-c9decf855ad5

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🤖 I'm sorry @doublegate, but I was unable to process your request. Please see the logs for more details.

[Copilot]

🟡 Changes recommended

The new XML escaping currently loses evidence for U+FFFE/U+FFFF by emitting a fixed \u{fffd} literal (and tests codify it), which contradicts the module’s stated evidence-preserving goal.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR remediates Rust supply-chain/security findings across the workspace (and the out-of-workspace fuzz crate) by upgrading vulnerable dependencies, removing unused advisory-carrying crates, and hardening hand-written Nmap-compatible XML output escaping.

Changes:

• Update Rust dependencies to eliminate active RustSec advisories/unsoundness warnings; remove unused quick-xml and tui-input, and deduplicate progress/TUI stacks via workspace dependency alignment.
• Centralize and strengthen XML escaping for -oX output into crates/prtip-cli/src/xml.rs, and route both XML emitters through it.
• Add/enable ongoing hygiene: Dependabot configuration, full cargo-deny checks in CI, and cargo audit coverage for the separate fuzz lockfile (with mirrored audit exemptions).

File summaries

File	Description
fuzz/Cargo.lock	Updates fuzz-target dependency graph to clear advisories in its separate lockfile.
fuzz/.cargo/audit.toml	Adds fuzz-local cargo audit ignore config mirroring the root rationale for rsa.
deny.toml	Removes stale ignores and updates license allowlist to match declared project licensing.
crates/prtip-tui/Cargo.toml	Drops unused tui-input dependency (and associated duplicate ratatui build).
crates/prtip-scanner/Cargo.toml	Switches indicatif to the workspace version to avoid duplicate builds and pick up fixes.
crates/prtip-cli/src/xml.rs	Introduces shared XML escaping implementation + tests for safe -oX output.
crates/prtip-cli/src/output.rs	Uses shared escape_xml for service name + banner in XML formatter.
crates/prtip-cli/src/main.rs	Registers the new xml module in the CLI binary crate.
crates/prtip-cli/src/lib.rs	Exposes the new xml module from the CLI library crate.
crates/prtip-cli/src/export.rs	Removes local XML escaping helper and uses shared escape_xml.
crates/prtip-cli/Cargo.toml	Removes unused quick-xml and bumps console to align with dependency updates.
CHANGELOG.md	Documents advisory remediation, XML hardening, CI/Dependabot additions, and supply-chain changes.
Cargo.toml	Bumps workspace dependency versions (e.g., indicatif, ratatui, crossterm).
.gitignore	Adjusts .cargo ignore rules to ensure audit config files remain tracked.
.github/workflows/ci.yml	Runs full cargo-deny checks and adds cargo audit for the fuzz lockfile.
.github/dependabot.yml	Adds Dependabot config with grouping for Cargo (workspace + fuzz), actions, and docker.
.cargo/audit.toml	Adds cargo audit ignore config documenting and constraining the rsa exemption.

Review details

Suppressed comments (1)

crates/prtip-cli/src/xml.rs:172

• This test encodes the current non-character behavior; if escape_xml preserves U+FFFE/U+FFFF visibly (rather than mapping both to \\u{fffd}), the assertions should be updated accordingly so the test continues to verify evidence-preserving escaping.

    #[test]
    fn renders_non_characters() {
        assert_eq!(escape_xml("a\u{FFFE}b"), "a\\u{fffd}b");
        assert_eq!(escape_xml("a\u{FFFF}b"), "a\\u{fffd}b");
    }

• Files reviewed: 15/18 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.