Cargo audit

[illuzen]

Summary

• Clear the cargo-audit vulnerabilities that blocked release publish: upgrade self_update to 1.0.0-rc.6 (drops vulnerable quick-xml 0.38; RUSTSEC-2026-0194 / 0195) and force event-listener 5.4.2 (RUSTSEC-2026-0221).
• Migrate quantus update to the self_update 1.0 API (asset_identifier, release_tag, Releases::latest(), getters, tempfile / self-replace instead of dropped re-exports).
• Make the CI security-audit job blocking (was continue-on-error) so advisories fail PRs before the release workflow; pin release cargo-audit to the same 0.22.1 as CI.

Still reported (warnings only — not fixable here without large upstream bumps)

Advisory	Crate	Why left
unmaintained	derivative, libsecp256k1, paste	via Substrate / ark / sp-*
unmaintained	proc-macro-error2	via subxt-macro 0.44 (still present in 0.50)
unsound	lru 0.12.5	via optional subxt-lightclient / smoldot-light 0.17 (^0.12); fixed in smoldot-light ≥1.3 / subxt 0.50 path

cargo audit after this PR: 0 vulnerabilities, 5 allowed warnings.

Test plan

• SKIP_CIRCUIT_BUILD=1 cargo check / clippy
• cargo audit → 0 vulnerabilities
• CI Security Audit job fails the workflow on vulns (no continue-on-error)
• Smoke quantus update --check against GitHub releases (self_update 1.0 path)

[n13]

Reviewer model: GPT Sol

Verdict: REQUEST_CHANGES

Blocking finding:

• src/cli/update.rs:257 (also lines 265 and 324): updater.target() already returns &str, but the new migration passes &target at all three call sites. The repository's required SKIP_CIRCUIT_BUILD=1 cargo clippy --locked --all-targets -- -D warnings check rejects these as needless_borrow / needless_borrows_for_generic_args, and GitHub's Analysis (Clippy & Doc) job is already failing at this head. Remove the extra & at all three sites so the blocking CI gate passes.

Validation at 6f708e7:

• git diff --check — passed.
• cargo +nightly fmt --all -- --check — passed.
• taplo format --check --config taplo.toml — passed.
• SKIP_CIRCUIT_BUILD=1 cargo test --locked --lib cli::update::tests:: — passed (4 tests).
• SKIP_CIRCUIT_BUILD=1 cargo build --locked --bin quantus — passed.
• End-to-end updater smoke test on a scratch copy — passed: fetched the real v1.5.0 macOS archive and checksum, verified SHA-256, extracted, replaced the scratch binary, and reported quantus 1.5.0.
• Local cargo audit was unavailable because cargo-audit is not installed; the PR's blocking Security Audit job passed.
• SKIP_CIRCUIT_BUILD=1 cargo clippy --locked --all-targets -- -D warnings — failed on the three new borrows above.

No other blocking findings found in the changed updater, dependency, or workflow behavior.

[n13]

Reviewer model: GPT Sol

Verdict: APPROVE

The previous blocking Clippy finding is resolved at aca12a7: the redundant borrows were removed from all three migrated self_update call sites, and the exact required Clippy command now passes. I found no other blocking issues in the updater migration, dependency resolution, or workflow changes.

Validation at aca12a7d0ce9576aa155c0e09d4a448cf184fa2a:

• Complete diff and follow-up commit inspected against base b8937340cb628ce829443ea164e1d2586920a737; git diff --check passed.
• cargo +nightly fmt --all -- --check passed.
• taplo format --check --config taplo.toml passed.
• SKIP_CIRCUIT_BUILD=1 cargo test --locked --lib cli::update::tests:: passed (4 tests).
• SKIP_CIRCUIT_BUILD=1 cargo clippy --locked --all-targets -- -D warnings passed.
• SKIP_CIRCUIT_BUILD=1 cargo build --locked --bin quantus passed.
• quantus update --check successfully exercised the live latest-release lookup.
• End-to-end updater smoke test on a scratch copy passed: selected the real v1.5.0 macOS asset and checksum, verified SHA-256, extracted, replaced the scratch binary, and reported quantus 1.5.0.
• The blocking CI Security Audit passed with zero vulnerabilities and five allowed upstream warnings; all six current GitHub checks are green.

No blocking findings.