fix(security): resolve all Dependabot advisories and audit gaps

.cargo/audit.toml

@@ -0,0 +1,37 @@
+# Configuration for `cargo audit` (RustSec).
+#
+# NOTE ON SCOPE: CI enforces advisories through `cargo deny`, configured in
+# `deny.toml`. This file exists for developers running `cargo audit` locally,
+# which is a different tool with a different view of the dependency graph --
+# see the entry below for why that difference matters.
+
+[advisories]
+ignore = [
+    # RUSTSEC-2023-0071 -- Marvin Attack in `rsa` (5.9 medium, no fix exists).
+    #
+    # `rsa` is never compiled into any ProRT-IP artifact. It reaches
+    # Cargo.lock only through `sqlx-mysql`, an *optional* dependency of `sqlx`.
+    # Cargo records every optional dependency in the lockfile regardless of
+    # whether its feature is enabled, and this workspace enables only
+    # `["runtime-tokio", "sqlite", "chrono"]` -- there is no MySQL backend.
+    #
+    # This is precisely where the two tools disagree, and the disagreement is
+    # the point:
+    #   * `cargo audit` parses Cargo.lock literally, so it sees `rsa` and
+    #     reports it. Hence this ignore.
+    #   * `cargo deny` resolves the real feature-aware graph, never encounters
+    #     `rsa`, and needs no ignore -- adding one there just produces an
+    #     "advisory-not-detected" warning.
+    #
+    # Verified rather than assumed:
+    #     cargo tree -i rsa        --workspace --target all   -> nothing to print
+    #     cargo tree -i sqlx-mysql --workspace --target all   -> nothing to print
+    #
+    # ProRT-IP performs no RSA operations and links no RSA code, so a timing
+    # sidechannel in RSA decryption is unreachable. There is no fixed version
+    # to upgrade to.
+    #
+    # REMOVE THIS ENTRY IF: a MySQL backend is ever enabled, or `cargo tree -i
+    # rsa` starts returning edges. Then the risk is real and must be reassessed.
+    "RUSTSEC-2023-0071",
+]

.github/PULL_REQUEST_TEMPLATE.md

@@ -74,7 +74,7 @@ Performance: [metrics if applicable]
 - [ ] Code follows project style guidelines (`cargo fmt`)
 - [ ] No clippy warnings (`cargo clippy --workspace --all-targets -- -D warnings`)
 - [ ] All tests pass (`cargo test --workspace`)
-- [ ] MSRV compatibility maintained (Rust 1.85+)
+- [ ] MSRV compatibility maintained (Rust 1.88+)
 - [ ] Documentation updated (if needed):
   - [ ] README.md statistics/features updated
   - [ ] CHANGELOG.md entry added

.github/dependabot.yml

@@ -0,0 +1,98 @@
+version: 2
+
+# Until this file existed, the repository received only Dependabot *security*
+# updates -- the ones GitHub opens without configuration. Routine version
+# updates were never proposed, so ordinary dependencies drifted until an
+# advisory forced the issue. That is how a `quick-xml` five minor versions
+# behind, and a duplicate `ratatui` major, went unnoticed.
+#
+# Grouping matters as much as enabling. Ungrouped, a workspace this size
+# produces a PR per crate per week and the noise gets ignored, which is the
+# same outcome as having no updates at all.
+
+updates:
+  # ---------------------------------------------------------------- Rust ----
+  - package-ecosystem: cargo
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(deps)"
+      prefix-development: "chore(dev-deps)"
+    labels:
+      - dependencies
+      - rust
+    groups:
+      # Patch and minor bumps carry no API change by semver, so they are safe
+      # to batch and review as one diff.
+      cargo-minor-patch:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
+      # Majors change APIs and must be read individually, so they are grouped
+      # only so far as keeping them out of the batch above.
+      cargo-major:
+        applies-to: version-updates
+        update-types:
+          - major
+      # Security fixes travel together and should be merged promptly.
+      cargo-security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  # The fuzz targets are a separate crate with their own lockfile, excluded
+  # from the workspace, so Dependabot needs to be pointed at them explicitly.
+  # They were previously invisible to it.
+  - package-ecosystem: cargo
+    directory: "/fuzz"
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: "chore(fuzz-deps)"
+    labels:
+      - dependencies
+      - fuzzing
+    groups:
+      fuzz-deps:
+        patterns:
+          - "*"
+
+  # ------------------------------------------------------- GitHub Actions ----
+  # Action versions are a supply-chain surface: a compromised or abandoned
+  # action runs with the workflow's token. These were not tracked at all.
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: "ci(deps)"
+    labels:
+      - dependencies
+      - github-actions
+    groups:
+      actions:
+        patterns:
+          - "*"
+
+  # ---------------------------------------------------------------- Docker ----
+  # The Dockerfile lives in /docker, not the repository root, so the directory
+  # has to say so -- a root-scoped entry would silently match nothing.
+  - package-ecosystem: docker
+    directory: "/docker"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 2
+    commit-message:
+      prefix: "build(docker)"
+    labels:
+      - dependencies
+      - docker

.github/workflows/ci.yml

@@ -277,22 +277,39 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Run cargo-deny
+      # `check advisories` alone left three of cargo-deny's four checks
+      # unenforced. The licence check in particular went unrun, so a
+      # `deny.toml` allow-list that no longer matched the workspace's declared
+      # licence could sit broken indefinitely. `bans` and `sources` are
+      # configured at "warn", so they report without failing the build.
+      - name: Run cargo-deny (advisories, licenses, bans, sources)
         uses: EmbarkStudios/cargo-deny-action@v2
         with:
           log-level: warn
-          command: check advisories
+          command: check
           arguments: --all-features
 
+      # The fuzz targets are excluded from the workspace and keep their own
+      # Cargo.lock, so nothing above reads them -- they carried unfixed
+      # advisories unnoticed. cargo-audit is used here rather than cargo-deny
+      # because it audits a lockfile directly, which is exactly what is needed
+      # for a crate outside the workspace graph.
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+
+      - name: Audit fuzz lockfile
+        working-directory: fuzz
+        run: cargo audit
+
   # Job 6: MSRV (Minimum Supported Rust Version) check
   msrv:
-    name: MSRV Check (1.85)
+    name: MSRV Check (1.88)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install Rust 1.85
-        uses: dtolnay/rust-toolchain@1.85
+      - name: Install Rust 1.88
+        uses: dtolnay/rust-toolchain@1.88
 
       - name: Install system dependencies
         run: sudo apt-get update && sudo apt-get install -y libpcap-dev pkg-config