[salesengr]

Lockfile-only update clearing the three RustSec advisories in hud/Cargo.lock that have a fix available. I found them by running every crates.io package in the lock (472) through OSV.

Advisories cleared

Crate	From → To	Advisory
quick-xml (via plist 1.9.0 → 1.10.1)	0.39.4 → 0.42.0	RUSTSEC-2026-0194: quadratic run time on duplicate attribute names (CVSS A:H)
		RUSTSEC-2026-0195: unbounded NsReader namespace allocation, memory-exhaustion DoS (CVSS A:H)
event-listener	5.4.1 → 5.4.2	RUSTSEC-2026-0221: !Send tags can cross threads via StackSlot

plist 1.9.0 pins quick-xml ^0.39.2, so the fix comes through plist 1.10.1 (which requires ^0.42.0) and adds base64 0.23.1. Both are semver-compatible bumps from cargo update -p event-listener -p plist; Cargo.toml is untouched.

Practical exposure is low: quick-xml is only reached through Tauri's plist handling of bundled files, not untrusted input. This is hygiene, so the lock stops showing up in audits.

Not fixable from here (left as-is)

• glib 0.18.5 (RUSTSEC-2024-0429): Tauri's GTK3 stack, Linux only; the fix is glib 0.20, which waits on Tauri.
• proc-macro-error 1.0.4 and unic-* 0.9.0: "unmaintained" notices with no fixed version, pulled in by Tauri/tauri-build.

Proof

Rebased onto current main (7a80243), which now includes the protocol-asset fix from #144:

$ cargo check --locked
    Finished `dev` profile [unoptimized + debuginfo] target(s)
(exit 0)

OSV reports no advisories for the new versions (quick-xml 0.42.0, event-listener 5.4.2, plist 1.10.1, base64 0.23.1); the three above are reported against the old ones. Only the unfixable items remain. Checked on macOS with cargo 1.96.1.

🤖 Generated with Claude Code