[puretensor]

Fix five quinn-proto denial-of-service advisories, the memmap2 and lru unsoundness advisories, and pytest's insecure temporary-directory advisory. The production application and existing tests require no code changes.

BEFORE / AFTER audits

Surface	BEFORE	AFTER
Rust, full Cargo.lock (all targets and optional dependencies)	8 vulnerability advisories; 2 unsoundness warnings; 2 unmaintained notices	3 vulnerability advisories (all zip holds); 0 unsoundness warnings; 2 unmaintained notices
Python, exact CI pytest pin and resolved dependencies	1 unique advisory in 1 package; pip-audit reports 2 duplicate records for PYSEC-2026-1845	0 advisories
Python dashboard	Stdlib-only; no third-party dependency manifest	Unchanged / no pip audit surface
JavaScript	No package.json or lockfile; dashboard uses built-in node:test	Unchanged / no npm audit surface
Own Dockerfile bases	No Dockerfiles	No work
Third-party service images	No Kubernetes/Compose/container image declarations	No work
CI action SHAs / tool downloads	SHA-pinned actions; fixed Rust/actionlint/cargo-deny/pytest versions	Action SHAs/tool pins unchanged except pytest; actionlint passes

Advisory	Package	Severity / classification	BEFORE	AFTER
RUSTSEC-2026-0338	quinn-proto	Unscored	Present	Gone
RUSTSEC-2026-0342	quinn-proto	Unscored	Present	Gone
RUSTSEC-2026-0185	quinn-proto	High (7.5)	Present	Gone
RUSTSEC-2026-0339	quinn-proto	Unscored	Present	Gone
RUSTSEC-2026-0340	quinn-proto	High (7.5)	Present	Gone
RUSTSEC-2026-0368	zip	Unscored	Present	Held
RUSTSEC-2026-0367	zip	High (7.3)	Present	Held
RUSTSEC-2026-0369	zip	High (8.1)	Present	Held
RUSTSEC-2025-0119	number_prefix	Unscored; unmaintained	Present	Held
RUSTSEC-2024-0436	paste	Unscored; unmaintained	Present	Held
RUSTSEC-2026-0253	lru	Unscored; unsound	Present	Gone
RUSTSEC-2026-0186	memmap2	Unscored; unsound	Present	Gone
PYSEC-2026-1845 / CVE-2025-71176	pytest	Medium	Present	Gone

Severity is taken from the advisory CVSS vector / GitHub advisory; Unscored means no severity is published, rather than an inferred rating. pip-audit emitted the same pytest advisory twice; counts distinguish raw records from unique IDs.

Every version change

Package / file	Old	New
quinn-proto (Cargo.lock)	0.11.14	0.11.19
memmap2 (Cargo.lock)	0.9.10	0.9.11
ratatui-core (Cargo.lock)	0.1.0	0.1.2
lru (Cargo.lock)	0.16.4	0.18.5
bitflags (Cargo.lock; ratatui-core now requires ^2.12)	2.11.1	2.13.2
pytest (.github/workflows/ci.yml)	8.3.5	9.0.3

New transitive lock entries required by these upgrades: approx 0.5.1, by_address 1.2.1, critical-section 1.2.0, palette 0.7.7, palette_derive 0.7.7, palette_math 0.7.7, rand_pcg 0.10.2, strum 0.28.0, strum_macros 0.28.0. The strum 0.28 entries coexist with older locked strum versions. No container digest changes.

Compatibility and scope

Updates use Cargo's precise-version resolver; lockfile hashes are generated by Cargo. The smallest public dependency surface changes are two patch releases and ratatui-core 0.1.2, whose updated lru constraint permits the fixed 0.18 line. lru has no fix in its old 0.16 compatibility line; the compatible parent patch absorbs its API change. bitflags and the new lock entries are required transitive changes. No application code, test assertions, package version, or deny policy changes.

pytest has no fixed 8.x release: 9.0.3 is the latest 9.0 patch and first fixed release. Reviewed the pytest changelog, including the 9.0 breaking-change list (Python >=3.10; overlapping/duplicate collection arguments; deprecated APIs now error). CI uses Python 3.x and two distinct test files; these tests need no workaround and all 51 pass unchanged. The Python major bump is limited to CI test tooling.

Remaining findings / HOLDS

• zip 7.2.0 — RUSTSEC-2026-0367 (High, 7.3), RUSTSEC-2026-0368 (Unscored), RUSTSEC-2026-0369 (High, 8.1): fixes require zip >=9.0.0, a major upgrade outside candle-core's dependency constraint. Current candle-core 0.10.2 requires zip ^7; the newest candle-core release 0.11.0 still requires zip ^8.6.0, verified against the crates.io dependency API. There is no released Candle upgrade reaching the fix. Existing deny.toml exceptions remain unchanged; they document that Candle reads entries rather than calling archive extract(). cargo audit still correctly reports these three vulnerabilities.
• paste 1.0.15 — RUSTSEC-2024-0436 (Unscored, unmaintained notice): no fixed version. Transitive compile-time dependency of Candle/tokenizers; existing deny.toml exception unchanged.
• number_prefix 0.4.0 — RUSTSEC-2025-0119 (Unscored, unmaintained notice): no fixed version. Transitive dependency through hf-hub 0.4.3 / indicatif 0.17; existing deny.toml exception unchanged.

Validation

The clean-main baseline at 715d04b6c32ac93c31dd112df05617bcbccd6972 passed the requested gate and cargo deny check advisories licenses sources. No pre-existing failures.

On this branch, with CARGO_TARGET_DIR=$PWD/target, CARGO_BUILD_JOBS=16, installed Rust 1.98.1 (matching CI), and a temporary test HOME:

• cargo fmt --all -- --check && cargo clippy --workspace --all-targets -- -D warnings && cargo test --workspace --locked — exit 0; 894 passed, 0 failed, 0 ignored across Rust test suites.
• cargo deny check advisories licenses sources — exit 0: advisories ok, licenses ok, sources ok (existing all-features graph policy; metadata only, no native-ml compilation).
• uvx pip-audit -r <extracted CI pin> — AFTER: No known vulnerabilities found.
• CI pytest contract invocation, using pytest 9.0.3 and Python 3.14.4: 51 passed in 26.78s.
• actionlint — exit 0.
• cargo audit --json — AFTER: 3 vulnerabilities and 2 unmaintained notices; exits 1 for the explicitly held zip advisories. All seven claimed Rust advisory removals were checked by ID against BEFORE/AFTER JSON.

Gate final output:

   Doc-tests ptask_tui

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

No native-ml feature build, deployment, container build, production datastore tests, or external messaging tooling was invoked. Tests use temporary SQLite databases and local fake services.