[al2wang]

cargo audit (run by tests/test-supply-chain.sh in the Dependency and license policy step) now fails on current main (2199b40). It reports five advisories against quinn-proto 0.11.16:

advisory	summary	fixed in
RUSTSEC-2026-0338	remote peer can panic on zero-length STREAM frames during unordered reads (high)	≥ 0.11.18
RUSTSEC-2026-0339	unbounded growth of pending connection-ID retirements	≥ 0.11.17
RUSTSEC-2026-0340	peer minimum ACK delay can panic with ACK_FREQUENCY (high)	≥ 0.11.18
RUSTSEC-2026-0341	stream-reassembly memory-exhaustion guard can be bypassed (high)	≥ 0.11.17
RUSTSEC-2026-0342	zero-length DATAGRAM frames bypass the receive-buffer limit	≥ 0.11.17

This PR is a lockfile-only bump to 0.11.19 (cargo update -p quinn-proto --precise 0.11.19). No other crate version moves; the only other lockfile change is that quinn-proto now depends on the getrandom 0.3.4 already in the lock.

Context: every PR that touches Cargo.lock runs the policy step, so any such PR currently fails on this advisory regardless of its own content (seen on #100's run 38314503799). Landing this separately keeps those PRs unchanged.

Validation: local cargo deny check, cargo about, tests/test-supply-chain.sh, fmt, clippy and workspace tests are running; I'll post the results here.

🤖 Generated with Claude Code

[al2wang]

Validation for 5f5a6d3c9f1d9b5568d29597b947e1fdcd1a1220:

• GitHub CI run 38315967327: all jobs passed; windows was skipped by the path plan.
  • On linux, Dependency and license policy passed. tests/test-supply-chain.sh ran cargo audit, which scanned 576 crates with no advisories.
  • Rust tests including platform security controls passed.
• Local, on a Linux compute node with the command sandbox available:
  • cargo fmt --all -- --check: clean.
  • cargo clippy --locked --workspace --all-targets -- -D warnings: clean.
  • cargo test --locked --workspace: 848 passed, 0 failed.
  • cargo deny check raised only the existing duplicate-version warnings.
  • The local cargo about step did not run (the tool was not installed); CI's policy step covers it.

Once this lands, #100 can get a fresh run on its unchanged head 04a70949.

[weiddeng]

Reviewed the lockfile-only security update at 5f5a6d3. The quinn-proto 0.11.19 bump resolves the reported advisories, remains compatible with the pinned toolchain, and passes the full required CI suite. No blocking findings.