From 7fa5d50ccf0d0dca8847450e3ffed4a9e680ead6 Mon Sep 17 00:00:00 2001
From: Loris Leiva <loris.leiva@gmail.com>
Date: Fri, 16 Oct 2026 10:37:58 +0100
Subject: [PATCH] Update rustls and time to fix cargo audit

This PR fixes the red Audit job on main by bumping `rustls` to 0.23.46 and `time` to 0.3.47 in the lockfile, which resolves four new RustSec vulnerabilities (RUSTSEC-2026-0346 to 0349) and lets us stop ignoring RUSTSEC-2026-0009.

It also removes the six stale `--ignore` flags (RUSTSEC-2026-0009, 0037, 0049, 0098, 0099 and 0104) from `make audit`, since none of those advisories fire any more. Keeping them would not save us future work. Because `Cargo.lock` is checked in, an advisory only comes back if we reintroduce a vulnerable version, for example through a downgrade or a new dependency pulling in an older major line. When that happens we want CI to flag it, rather than have a stale ignore quietly let it through. If one does come back and can't be bumped, we can re-add the ignore with a comment explaining why. The remaining ignores still fire on old major lines with no compatible patch.
---
 Cargo.lock | 28 ++++++++++++++--------------
 Makefile   |  6 ------
 2 files changed, 14 insertions(+), 20 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index f3a43af..7301087 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1077,12 +1077,12 @@ dependencies = [
 
 [[package]]
 name = "deranged"
-version = "0.4.1"
+version = "0.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28cfac68e08048ae1883171632c2aef3ebc555621ae56fbccce1cbf22dd7f058"
+checksum = "9e9de72ce2ad1f90dc62fa25f0f430ef85eb4b0d8fa0be4f30373bc40a21d28e"
 dependencies = [
  "powerfmt",
- "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -2387,9 +2387,9 @@ dependencies = [
 
 [[package]]
 name = "num-conv"
-version = "0.1.0"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
 
 [[package]]
 name = "num-derive"
@@ -3084,9 +3084,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.45"
+version = "0.23.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
 dependencies = [
  "once_cell",
  "ring",
@@ -6257,30 +6257,30 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.41"
+version = "0.3.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a7619e19bc266e0f9c5e6686659d394bc57973859340060a69221e57dbc0c40"
+checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
 dependencies = [
  "deranged",
  "itoa",
  "num-conv",
  "powerfmt",
- "serde",
+ "serde_core",
  "time-core",
  "time-macros",
 ]
 
 [[package]]
 name = "time-core"
-version = "0.1.4"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9e9a38711f559d9e3ce1cdb06dd7c5b8ea546bc90052da6d06bb76da74bb07c"
+checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
 
 [[package]]
 name = "time-macros"
-version = "0.2.22"
+version = "0.2.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3526739392ec93fd8b359c8e98514cb3e8e021beb4e5f597b00a0221f8ed8a49"
+checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
 dependencies = [
  "num-conv",
  "time-core",
diff --git a/Makefile b/Makefile
index a0250e3..63081c7 100644
--- a/Makefile
+++ b/Makefile
@@ -24,12 +24,6 @@ audit:
 	cargo audit \
 		--ignore RUSTSEC-2022-0093 \
 		--ignore RUSTSEC-2024-0344 \
-		--ignore RUSTSEC-2026-0009 \
-		--ignore RUSTSEC-2026-0037 \
-		--ignore RUSTSEC-2026-0049 \
-		--ignore RUSTSEC-2026-0098 \
-		--ignore RUSTSEC-2026-0099 \
-		--ignore RUSTSEC-2026-0104 \
 		$(ARGS)
 
 spellcheck: