From b8dcfd59bae212df4f7b43d6228b02d36a64955d Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 4 Nov 2026 23:50:35 +0000 Subject: [PATCH] fix(deps): resolve RUSTSEC-2026-0433 in the root lockfile Both cargo-audit jobs (`Dependency audit`, `rust-ci / Cargo audit`) are red on main and on #458 for RUSTSEC-2026-0433: pulldown-cmark 0.13.5, quadratic parsing of nested image wikilinks (CVSS 7.5, 2026-10-28). `cargo update -p pulldown-cmark --precise 0.13.6` changes only that package's version and checksum. It is a build dependency of echidna-grpc (via prost-build / tonic-prost-build). The fuzz workspace has no pulldown-cmark entry. Same shape as #457 (RUSTSEC-2026-0414). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01KUZiEB43T3E9fJAXqwbSDm --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index c9629440..8de9b9ef 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2634,9 +2634,9 @@ dependencies = [ [[package]] name = "pulldown-cmark" -version = "0.13.5" +version = "0.13.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "278e9268c93b9e498a2da46c34d90ba93a3255eb99009646398f34bc73ab36eb" +checksum = "3db2be46835f013dd3f4fa7f5f7402c537787b54ebb6fe2b94bbdd7e2669bb7b" dependencies = [ "bitflags", "memchr",