fix(deps): bump quinn-proto to 0.11.19 (RUSTSEC-2026-0338..0342)

[ilya-bogin-keenable]

Lockfile-only bump of quinn-proto from 0.11.15 to 0.11.19. It fixes five RustSec advisories, RUSTSEC-2026-0338 to 0342, published after the last green main run: memory-exhaustion bypasses and remotely triggerable panics.

cargo audit fails the required fmt · clippy · test · audit job on every PR right now. That includes #74, the bridge retry change.

cargo update -p quinn-proto also moved a few transitive crates: rand_core 0.10 and rand_pcg, and dropped zerocopy. All of these run green locally:

• cargo fmt --check
• cargo clippy --locked --all-targets --all-features -D warnings
• cargo test --locked --all-features: 20 passed
• cargo audit: only the existing allowed unsafe-libyaml unmaintained warning remains

🤖 Generated with Claude Code

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can turn these tips off under Display > Comment parts

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[github-actions]

Auto-approved: Qodo review completed — 🐞 Bugs (0),📘 Rule violations (0) 📎 Requirement gaps (0). Findings are advisory per team policy; verdict source: #75 (comment) [auto-approve.yml]

[qodo-code-review]

PR Summary by Qodo

Bump quinn-proto to 0.11.19 to address five RustSec advisories

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Pin quinn-proto 0.11.19 to address five RustSec advisories and unblock the required audit job.
• Refresh transitive dependencies without changing application source or the dependency manifest.

Diagram

graph TD
  Audit["CI audit"] --> Lock["Cargo.lock"] --> Reqwest["reqwest"] --> Quinn["quinn"] --> Proto["quinn-proto"] --> Rand["rand 0.10"]

Loading

High-Level Assessment

Keep the targeted lockfile bump. Updating direct HTTP dependencies or application code would broaden the change without addressing the immediate need to resolve the quinn-proto advisories.

Files changed (1) +40 / -68

Other (1) +40 / -68

Cargo.lockPin patched quinn-proto and refresh its transitive dependencies +40/-68

Pin patched quinn-proto and refresh its transitive dependencies

• Updates quinn-proto from 0.11.15 to 0.11.19, the version intended to address five RustSec advisories. The new resolution moves rand to 0.10, adds rand_pcg and related crates, consolidates getrandom usage, and removes unused older random-number dependencies including zerocopy.

Cargo.lock