From 7d232ea4c3b1b5e6920e683c80c25f3853c33568 Mon Sep 17 00:00:00 2001
From: Chris Phillipson <christopher.a.phillipson@gmail.com>
Date: Sun, 9 Aug 2026 15:21:36 -0700
Subject: [PATCH] fix(security): resolve RUSTSEC-2026-0204 and rkyv advisories
 blocking CI

- Update crossbeam-epoch 0.9.18 -> 0.9.20 (RUSTSEC-2026-0204)
- Update rkyv 0.8.16 -> 0.8.17 (RUSTSEC-2026-0233/0234/0235)
- Ignore RUSTSEC-2026-0235 in .cargo/audit.toml for the remaining
  rkyv 0.7.46 lockfile entry: rust_decimal's unused optional legacy
  feature, never compiled, no patched 0.7.x exists

Unblocks the Backend Security Audit gate failing on all PRs (e.g. #78).
---
 .cargo/audit.toml |  8 +++++++-
 Cargo.lock        | 18 +++++++++---------
 deny.toml         |  4 ++++
 3 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/.cargo/audit.toml b/.cargo/audit.toml
index ef202a16..be82a1fc 100644
--- a/.cargo/audit.toml
+++ b/.cargo/audit.toml
@@ -7,4 +7,10 @@
 # This is a transitive dependency from sqlx-mysql (via sea-orm's sqlx feature).
 # Since this project uses PostgreSQL (not MySQL), this vulnerability does not
 # affect the application. Ignoring until an upstream fix is available.
-ignore = ["RUSTSEC-2023-0071"]
+# RUSTSEC-2026-0235: rkyv archive validation out-of-bounds reads
+# Status: Fixed only in rkyv >=0.8.17 (no patched 0.7.x release)
+# The workspace's only rkyv 0.7 entry comes from rust_decimal's OPTIONAL
+# legacy `rkyv` feature, which this project never enables — the crate is
+# locked but never compiled. rkyv 0.8.x is kept at >=0.8.17 (patched).
+# Remove when rust_decimal drops its optional rkyv 0.7 dependency.
+ignore = ["RUSTSEC-2023-0071", "RUSTSEC-2026-0235"]
diff --git a/Cargo.lock b/Cargo.lock
index b207e82d..59e2f643 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1124,9 +1124,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]
@@ -4200,9 +4200,9 @@ dependencies = [
 
 [[package]]
 name = "rkyv"
-version = "0.8.16"
+version = "0.8.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73389e0c99e664f919275ab5b5b0471391fe9a8de61e1dff9b1eaf56a90f16e3"
+checksum = "815cc8a37159a463064825246cadb07961e25cd9885908606f6d08a98d8f8874"
 dependencies = [
  "bytecheck 0.8.2",
  "bytes",
@@ -4212,7 +4212,7 @@ dependencies = [
  "ptr_meta 0.3.1",
  "rancor",
  "rend 0.5.3",
- "rkyv_derive 0.8.16",
+ "rkyv_derive 0.8.17",
  "tinyvec",
  "uuid",
 ]
@@ -4230,9 +4230,9 @@ dependencies = [
 
 [[package]]
 name = "rkyv_derive"
-version = "0.8.16"
+version = "0.8.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d2ed0b54125315fb36bd021e82d314d1c126548f871634b483f46b31d13cac6"
+checksum = "c0ed1a78a1b19d184b0daa629dd9a024573173ec7d485b287cb369fb3607cc1c"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4493,7 +4493,7 @@ dependencies = [
  "parking_lot",
  "rand 0.8.6",
  "rand_distr",
- "rkyv 0.8.16",
+ "rkyv 0.8.17",
  "serde",
  "serde_json",
  "thiserror 2.0.18",
@@ -5407,7 +5407,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
  "once_cell",
  "rustix",
  "windows-sys 0.61.2",
diff --git a/deny.toml b/deny.toml
index 2756a756..8b17a1dd 100644
--- a/deny.toml
+++ b/deny.toml
@@ -33,6 +33,10 @@ ignore = [
     # proc-macro-error2 unmaintained. Transitive proc-macro dependency.
     "RUSTSEC-2026-0173",
 ]
+# NOTE: RUSTSEC-2026-0235 (rkyv OOB reads) is ignored in .cargo/audit.toml
+# only: cargo-deny resolves the real feature graph and never sees the
+# vulnerable rkyv 0.7 (rust_decimal's unused optional legacy feature),
+# while cargo-audit scans the raw lockfile and does.
 
 [licenses]
 # Allow common open-source licenses used in the Rust ecosystem