[LKSNDRTMLKV]

Summary

Security audit is red on main and on every open PR. It is not the dependabot bump (#464): RustSec published four advisories on 19 and 20 October against crates already in Cargo.lock, so any commit fails the audit now. Three clear with patch bumps. The fourth sits in a crate that cannot be bumped, so the feature that pulls it in is switched off and the leftover lockfile entry is registered as not in the graph, which the repo's own script verifies.

Related issue

None. Same shape as #476 and #480.

Changes

• rustls-webpki 0.103.15 → 0.103.16, webpki-roots and webpki-root-certs 1.0.9 → 1.0.10 (Cargo.lock only), clearing RUSTSEC-2026-0382, -0381 and -0383. rustls-webpki verifies every TLS connection the node makes through reqwest, sqlx and the NATS client, so the first is reachable. The existing requirements already allowed the patches.
• async-nats is declared without its websockets feature (Cargo.toml: its default features minus that one). webpki-roots 0.26.11 carries RUSTSEC-2026-0381 too and cannot move: only tokio-websockets 0.10 pulls it in, async-nats 0.50 pins that, and 0.50.0 is the newest release. Nothing here configures a ws:// or wss:// NATS URL, so the transport was dead weight. A WebSocket NATS URL is no longer supported by the client.
• .cargo/audit.toml: RUSTSEC-2026-0381 registered as not-in-graph. The crate stays in Cargo.lock because async-nats names it in a weak feature (tokio-websockets?/ring) and cargo records that edge whether or not the feature is on; cargo audit reads the lockfile. The entry is void if websockets is re-enabled, and it expires 2027-01-18.
• CHANGELOG.md: an entry under Unreleased → Fixed.

Things to know

• The not-in-graph claim is checked, not asserted. scripts/check-audit-register.sh runs cargo tree -i webpki-roots@0.26.11 --target all against the default graph and the shipped image build (-p dpp-node --features s3). I also re-enabled websockets in a scratch copy and confirmed the script then fails the entry in both graphs, so the green result can fail.
• owner: LKSNDRTMLKV on the new entry records the founder's sign-off, as on the other entries.
• Open PRs need an update from main after this lands to pick up the patched lockfile; their Security audit will keep failing until then.

Checklist

• Tests added or updated for new behaviour — no behaviour of ours changed; the audit and register checks are the tests
• just lint passes locally (part of just check)
• just fmt applied (fmt-check in just check)
• just test passes (unit): 1493 passed, 3 skipped
• just test-integration — not run; nothing in persistence, lifecycle or auth changed, and CI runs the Docker tiers
• No println!/eprintln!/dbg! in service-crate src/ — just debug-check, in just check
• No secrets, credentials, or .env files in the diff (four files: Cargo.toml, Cargo.lock, .cargo/audit.toml, CHANGELOG.md)
• Docs updated if a public API, endpoint, or CLI command changed — CHANGELOG
• No DB schema change
• just check ends green locally, including cargo audit --deny yanked --deny unmaintained, cargo deny and check-audit-register.sh (5 entries, all current)