[alangou]

Summary

Update hickory-proto from 0.26.1 to 0.26.2 in all seven affected Cargo lockfiles. This fixes five RustSec findings, including malformed DNS decoding and record-count memory amplification on the supervisor's policy-DNS path.

Related Issue

N/A, no issue per user instruction. This run addresses public dependency advisories.

Changes

• One dependency-scoped commit updates the root, governance-interceptor, and five aligned test workspace lockfiles. Content-guard keeps its already patched 0.26.3.
• Fixes RUSTSEC-2026-0487, 0488, 0489, 0490, and 0491. The 0.26.2 release is the smallest patched version accepted by existing constraints.
• Native Cargo updates also rebind 29 Windows-only references to existing windows-sys versions within their parent constraints. No other package versions change. Linux checks do not establish Windows runtime coverage.
• No source, test, manifest, build-logic, or advisory-policy changes.

Both existing deny.toml exceptions were reassessed on November 12 against current releases and all 12 Cargo locks. They remain unresolved and unchanged:

• RSA / RUSTSEC-2023-0071: published RSA 0.10.0 is patched, but installed russh 0.65.0 and latest 0.65.1 pin RSA 0.10.0-rc.18. Resolver probes also reject upgrading the 0.9.10 test fixtures independently. Remove the exception after a released russh accepts patched RSA and every SSH and fixture occurrence is upgraded and validated.
• SQLite / RUSTSEC-2026-0459: latest sqlx-sqlite 0.9.0 excludes patched libsqlite3-sys >=0.39.0. The parent-bound fix remains unreleased. Remove the exception after a compatible SQLx release permits upgrading and validating all ten affected locks.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (not applicable; existing suites exercise the dependency consumers)
• E2E tests added/updated (not applicable; existing Docker policy-DNS scenario selected)

Completed: lockfile consistency and alignment, full root cargo-deny with crypto-policy tests, all 11 independent advisory scans, formatting, compile checks, Clippy, and independent resolution/checksum review. No vulnerable Hickory occurrence remains. Complete Dependabot inventory returned zero open alerts. Unmasking the retained exceptions still reports RSA and SQLite.

All maintained Rust test commands passed. Only the workspace command adds -- --test-threads=1; server and independent workspace commands remain unchanged, and RUST_TEST_THREADS is unset. No tests or features were disabled. Local Docker conformance passed 22/22, followed by the passing transparent_tcp policy-DNS scenario, with binaries and images rebuilt from this branch. Two Podman-only cases in that target return early under Docker and do not provide Podman coverage.

Default-parallel runs hit a sandbox listener-lifetime assertion also reproduced on pristine main with Hickory 0.26.1. A four-thread retry hit a different raw-descriptor assertion, not reproduced on baseline. The final serialized workspace run passed all 307 sandbox tests, including both assertions. The parallel failures remain a validation limitation.

SHA-bound admission created the matching mirror with test:e2e already applied. Branch E2E Checks, attempt 1 and Branch Checks are in progress. E2E builds are running; the remote test outcome is pending.

Review Readiness failed while unchanged merged-main automation requested reviewers. Its helper suppresses the captured GitHub API error, so the HTTP cause is unknown. The automation owner needs to expose and resolve that error before rerunning. PR Issue Acceptance, DCO, and Vouch passed.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied, but pull-request/5513 does not exist yet. A maintainer needs to comment /ok to test f6b978d9b696a2dc9070c7f5a7a24d28a537a094 to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[alangou]

/ok to test f6b978d