deps: bump four dependencies with RUSTSEC advisories

[0xrlawrence]

Summary

cargo audit reports five vulnerabilities on main. This clears four of them with lockfile-only, semver-compatible updates.

Crate	Bump	Advisory
quinn-proto	0.11.14 → 0.11.17	RUSTSEC-2026-0185 (7.5 high)
h2	0.4.13 → 0.4.19	RUSTSEC-2026-0258
ruint	1.17.2 → 1.20.0	RUSTSEC-2026-0220
crossbeam-epoch	0.9.18 → 0.9.20	RUSTSEC-2026-0204

After: cargo audit reports 1 vulnerability, down from 5.

quinn-proto is the notable one. Remote memory exhaustion via unbounded out-of-order stream reassembly, reachable through libp2p-quic when a node is configured with a QUIC multiaddr (hardcoded_config.rs has a test covering /ip4/127.0.0.1/udp/27000/quic-v1).

Not included: rmcp

The fifth advisory, RUSTSEC-2026-0189 on rmcp 0.16.0, needs 0.16 → 1.4. That is a major bump requiring API migration in crates/quake, which does not belong in a lockfile-only change. Left for a separate PR.

On the added ark-* entries

The diff adds ark-ff 0.6.0, ark-serialize 0.6.0, ark-std 0.6.0, and rand_pcg. This is not new dependency surface: the lockfile already carried ark-ff 0.3.0, 0.4.2, and 0.5.0, and ruint 1.20.0 adds optional support for the 0.6.0 line alongside them. These are feature-gated and not enabled by this workspace.

Verification

• cargo audit confirms all four advisories cleared
• cargo check -p arc-evm -p arc-precompiles passes

The ruint bump was the one worth checking directly, since it backs alloy-primitives and therefore U256 in the EVM. I verified those two crates type-check; I would suggest letting CI run the full workspace test suite before merging, as I could not run it locally.

🤖 Generated with Claude Code

[osr21]

Verified the individual claims, and they all check out — but the baseline moved underneath this PR, which changes the conclusion.

Claim verification (all pass):

• All four RUSTSEC IDs map to the right crates, and every bump lands inside the advisory's patched range (quinn-proto ≥0.11.15, h2 ≥0.4.16, ruint ≥1.20.0, crossbeam-epoch ≥0.9.20).
• All four new Cargo.lock checksums match crates.io exactly (quinn-proto 0.11.17, h2 0.4.19, ruint 1.20.0, crossbeam-epoch 0.9.20) — no supply-chain concern in the pinned artifacts.
• The reachability claim is accurate: hardcoded_config.rs has build_consensus_config_supports_quic_multiaddr parsing /ip4/127.0.0.1/udp/27000/quic-v1, so the quinn-proto DoS surface is real for QUIC-configured nodes.

However — #285 (the v0.8.0 sync, merged this morning) already resolved all five advisories on main:

Crate	Advisory patched range	main now has	Status
quinn-proto	≥ 0.11.15	0.11.15	✅ already patched
h2	≥ 0.4.16	0.4.16	✅ already patched
ruint	≥ 1.20.0	1.20.0	✅ already patched
crossbeam-epoch	≥ 0.9.20	0.9.20	✅ already patched
rmcp	≥ 1.4.0	1.4.0	✅ already patched — including the major bump this PR deferred

This PR was branched before that merge, so its "5 vulnerabilities on main" snapshot describes the pre-#285 lockfile — and the #285 lockfile rewrite is why this PR now shows a merge conflict. A fresh cargo audit against current main should come back clean on all five, including RUSTSEC-2026-0189: the v0.8.0 sync already did the rmcp 0.16 → 1.4 API migration in crates/quake that the "Not included" section deferred.

What's left of value here: the only delta this PR would add over main is quinn-proto 0.11.15 → 0.11.17 and h2 0.4.16 → 0.4.19 — nice-to-have freshness, but not advisory-driven; main's versions already satisfy the patched ranges. Unless maintainers want those extra patch bumps, this can be closed as superseded by #285.

One observation that becomes moot on close, but worth noting for any future lockfile PR: the diff carries collateral resolution churn well beyond the four targeted crates — socket2 downgrades (0.6.2 → 0.5.10 for hyper/quinn/quinn-udp), itertools splitting to 0.14.0/0.12.1, windows-sys 0.59 → 0.61 across several crates. That's the signature of regenerating against a stale base rather than targeted cargo update -p <crate> --precise <ver> runs; targeted updates keep the diff auditable line-by-line.

[melekes]

Thanks for this!

We checked against internal main and these advisories are already cleared.

Going to close this one out since it's largely superseded, but genuinely appreciate you taking the time to contribute — please keep them coming.

[osr21]

@melekes Confirmed the public mirror matches: current main (66ad2d5 / v0.8.0) pins quinn-proto 0.11.15, h2 0.4.16, ruint 1.20.0, crossbeam-epoch 0.9.20, and rmcp 1.4.0 — all five advisories inside patched ranges, so a fresh cargo audit here comes back clean too. Closing as superseded is right.

One small suggestion that would have prevented this exact duplicate: the v0.8.0 changelog entry ("Remediate cargo audit advisories via dependency bumps") doesn't name the RUSTSEC IDs. Listing them (RUSTSEC-2026-0185/-0258/-0220/-0204/-0189 here) would let external contributors and scanners confirm coverage from the release notes alone, instead of diffing the lockfile — cheap to add at release time, and it shrinks the window where advisory-driven PRs get filed against already-fixed internal state.