[jatmn]

Summary

Clears three Dependabot alerts on Cargo.lock: hickory-resolver (#17), hickory-proto (#2), and serde_with (#14). The hickory fix needs libp2p-dns 0.45, which only works with the newer libp2p release line, so the node's libp2p crates move to it. Now that the fix is in, this also drops the two hickory cargo audit ignores.

Motivation & context

• hickory-proto/hickory-resolver 0.25.2 come in only through libp2p-dns 0.44 (hickory-resolver ^0.25.2). They are reachable: the QUIC transport is wrapped in the system DNS resolver (crates/gitlawb-node/src/p2p/mod.rs:243).
  • GHSA-q2qq-hmj6-3wpp / RUSTSEC-2026-0119: O(n²) name compression, patched in 0.26.1.
  • GHSA-6f2x-v7q7-m7m5: resolver follows irrelevant CNAME records, patched in 0.26.2.
  • RUSTSEC-2026-0118: NSEC3 unbounded loop.
• libp2p-dns 0.45.0 (2026-09-11) is the first release on hickory ^0.26, and it requires libp2p-core ^0.44 / libp2p-identity ^0.3.
• serde_with 3.18.0 comes in through alloy-eips. GHSA-7gcf-g7xr-8hxj is patched in 3.21.0, and ^3 allows a lockfile-only bump.

Closes #76

Kind of change

• Bug fix
• Feature
• Security fix
• Docs
• Tests / CI
• Refactor (no behavior change)
• Breaking or protocol change (issue required first)

What changed

• crates/gitlawb-node/Cargo.toml: libp2p-core 0.44, libp2p-gossipsub 0.50.1, libp2p-identify 0.48, libp2p-identity 0.3, libp2p-kad 0.49, libp2p-quic 0.14, libp2p-swarm 0.48, libp2p-dns 0.45.
  • multiaddr moves to 0.19 to match libp2p-core 0.44. No source file uses it directly, and otherwise two copies would be compiled.
  • No source changes were needed.
• Cargo.lock:
  • hickory-proto/resolver 0.25.2 → 0.26.3.
  • serde_with(+macros) 3.18.0 → 3.22.0.
  • The libp2p crates above, plus transitive changes those version requirements force. A minimal re-resolution from the old lockfile gives the same set: tokio 1.54, regex 1.13, mio 1.2, prost in place of quick-protobuf.
  • The wasm-bindgen family goes down to 0.2.108 because libp2p-swarm 0.48.0 pins wasm-bindgen-futures = "=0.4.58". That only matters for wasm targets.
  • No newly added package declares a rust-version above 1.91.
• .cargo/audit.toml: removed the RUSTSEC-2026-0118/0119 ignores and their tracking comment, per Drop hickory advisory ignores once libp2p-dns ships hickory 0.26 #76. The rsa and crypto-bigint ignores are unchanged.
• audit-schedule.yml is unchanged. hickory-proto stays in the lockfile at 0.26.3 and the ignores are gone, so the drift guard extracts the version and passes. The pipefail false-red raised on Drop hickory advisory ignores once libp2p-dns ships hickory 0.26 #76 only happens when hickory-proto is absent from the lockfile, which isn't the case here.

How a reviewer can verify

grep -A1 -E '^name = "(hickory-proto|hickory-resolver|serde_with)"' Cargo.lock
cargo audit                                   # exit 0 with the remaining ignores
cargo fmt --all -- --check
cargo clippy --locked --workspace --all-targets -- -D warnings
cargo +1.91 check --locked --workspace --all-targets
DATABASE_URL=postgres://… cargo test --locked --workspace
cargo build --locked --release --workspace
docker build -t gitlawb-node:ci-test . && docker run --rm gitlawb-node:ci-test --version

Local results on 10caed3:

Check	Result
fmt	pass
clippy (-D warnings)	pass
MSRV 1.91 check	pass
cargo audit 0.22.2	pass
cargo test --workspace (Postgres 16)	1692 passed, 0 failed, 4 ignored
release build	pass
Docker build + --version	pass

cargo audit with no ignores, before and after:

• RUSTSEC-2026-0118 and RUSTSEC-2026-0119 are gone.
• rsa and crypto-bigint remain.
• No new warnings appear, and the tokio unsound warning is cleared.

Before you request review

• Scope is one logical change; no unrelated churn
• cargo test --workspace passes locally
• New behavior is covered by tests (required for fixes): N/A, dependency bump with no behavior change; covered by the existing suite and cargo audit
• cargo fmt --all and cargo clippy --workspace --all-targets -- -D warnings are clean
• Commit titles use Conventional Commits (feat(...), fix(...), docs(...))
• Docs / .env.example updated if behavior or config changed (or N/A)
• Checked existing PRs so this isn't a duplicate

Protocol & signing impact

• Touches DID / did:key, Ed25519 / RFC 9421 signatures, UCAN, ref certs, or P2P wire formats: P2P stack version only
• Discussed in an issue before implementation (Drop hickory advisory ignores once libp2p-dns ships hickory 0.26 #76)
• Backward-compatible with existing nodes and previously signed history (see notes)

Notes for reviewers

• Upstream changelogs for these releases show no protocol-ID or wire-format changes. The protobuf codec moves back from quick-protobuf to prost, which encodes the same messages.
• Behavior changes worth knowing:
  • gossipsub 0.50 caps topic subscriptions at 100 by default. The node uses one topic (REF_UPDATES_TOPIC), so this has no effect.
  • gossipsub 0.50 adds a 16 KB control-message limit.
  • gossipsub 0.50.1 ignores PRUNE messages for topics the node hasn't joined (an advisory fix).
  • QUIC 0.14 prefers the X25519MLKEM768 key exchange, falling back to classic groups during negotiation.
  • libp2p-identity 0.3's low-S rule applies only to secp256k1. The node uses Ed25519.
• Not tested: a live run mixing this node with peers still on the libp2p 0.43 line.
• test_support::tests::sweep_backs_off_after_a_run_that_repairs_nothing failed once locally under full-suite load. It uses 200 ms / 800 ms wall-clock windows. It passed in the other two full runs and 5/5 times on its own, so it looks like a timing flake unrelated to this change.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Maintenance
  • Updated the app’s underlying peer-to-peer networking components.
  • Security audit results now include advisories that were previously suppressed.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The node crate updates its libp2p dependencies, including libp2p-dns. The Cargo audit configuration removes its previous advisory ignores.

Changes: Node dependency and audit updates

Layer / File(s)	Summary
Update libp2p dependency versions .cargo/audit.toml, crates/gitlawb-node/Cargo.toml	The node manifest updates libp2p dependency versions, including libp2p-dns. Existing Tokio and identity features remain unchanged.
Remove audit advisory ignores .cargo/audit.toml	The audit ignore list is empty. It no longer suppresses the hickory, RSA, or crypto-bigint advisories.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: crate:node, kind:bug

Suggested reviewers: beardthelion

Merge Risk: Minimal · up to 10cae

No actionable merge-blocking risk remains in the reviewed changes; the PR is ready to merge subject to normal checks.

Pre-merge checks: 4 · 1

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Out of Scope Changes check		The hickory, libp2p, and multiaddr changes in crates/gitlawb-node/Cargo.toml support #76 and the stated dependency bump, so they are in scope. The serde_with bump (Dependabot #14) and the transitive l…	Confirm the final .cargo/audit.toml content at head 10caed3. The file must keep the rsa and crypto-bigint ignores, with only RUSTSEC-2026-0118 and RUSTSEC-2026-0119 removed, as the PR description states. If the rsa or crypto-bigint ignores…

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title names the main change: bumping libp2p to pick up the hickory 0.26 and serde_with 3.22 fixes. The raw summary and objectives confirm a libp2p dependency bump in Cargo.toml, with the lockfile …
Description check		The description covers the required template sections: Summary, Motivation and context (with a closes reference to #76), Kind of change (Security fix checked), What changed, How a reviewer can verify …
Linked Issues check		[#76] Two coding requirements apply. (1) Bump libp2p-dns to a release that uses hickory >=0.26.1. The reviewable change in crates/gitlawb-node/Cargo.toml raises libp2p-dns from 0.44.0 to 0.45.0, with …
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…

Full details: Title check

Explanation

The title names the main change: bumping libp2p to pick up the hickory 0.26 and serde_with 3.22 fixes. The raw summary and objectives confirm a libp2p dependency bump in Cargo.toml, with the lockfile updates and removed audit ignores that come with it. The title uses the Conventional Commits form. It omits the audit-ignore removal, which is expected.

Full details: Description check

Explanation

The description covers the required template sections: Summary, Motivation and context (with a closes reference to #76), Kind of change (Security fix checked), What changed, How a reviewer can verify (commands and a results table), the pre-review checklist, Protocol and signing impact, and Notes for reviewers. The author filled in the checklist and explained the choices. The one unchecked item, the test-coverage requirement for fixes, is marked N/A with a reason, so the description is complete.

Full details: Linked Issues check

Explanation

[#76] Two coding requirements apply. (1) Bump libp2p-dns to a release that uses hickory >=0.26.1. The reviewable change in crates/gitlawb-node/Cargo.toml raises libp2p-dns from 0.44.0 to 0.45.0, with the matching libp2p line (core 0.44, identity 0.3, swarm 0.48, and others). The PR description states that libp2p-dns 0.45 uses hickory ^0.26. (2) Remove RUSTSEC-2026-0118 and RUSTSEC-2026-0119 from .cargo/audit.toml. The reviewable summary of .cargo/audit.toml shows both hickory ignores removed. The #76 enforcement step describes the existing audit-schedule.yml workflow. The issue does not require changing that workflow, and the PR leaves it unchanged. Cargo.lock is excluded from review (ignored_files, rule !**/*.lock), so the resolved hickory-proto 0.26.3 version is not independently verified. This does not block the verdict, because the required bump and ignore removal are visible in reviewable files.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Out of Scope Changes check

Explanation

The hickory, libp2p, and multiaddr changes in crates/gitlawb-node/Cargo.toml support #76 and the stated dependency bump, so they are in scope. The serde_with bump (Dependabot #14) and the transitive lockfile changes (tokio, regex, mio, prost, wasm-bindgen) are described in the PR but are not linked issues. Cargo.lock is excluded from review (ignored_files, rule !**/*.lock), so these changes cannot be inspected. The PR description says the lockfile changes are forced by the libp2p bump and the serde_with bump, which fits the stated purpose. The .cargo/audit.toml summary conflicts with the PR description. The summary says the ignore list is now empty and that the hickory, RSA, and crypto-bigint suppressions were all removed (+0/-15). The PR description says only the RUSTSEC-2026-0118 and RUSTSEC-2026-0119 ignores were removed, and that the rsa and crypto-bigint ignores remain. If the rsa and crypto-bigint ignores were removed, that change is unrelated to #76 and to the PR's stated scope. The AI-generated summary cannot settle this conflict, and no read-only inspection of the file was available to this assessment.

Resolution

Confirm the final .cargo/audit.toml content at head 10caed3. The file must keep the rsa and crypto-bigint ignores, with only RUSTSEC-2026-0118 and RUSTSEC-2026-0119 removed, as the PR description states. If the rsa or crypto-bigint ignores were removed, restore them or justify their removal with a linked issue or a fixed dependency. Also confirm that the Cargo.lock changes match the PR description: serde_with 3.22.0 and the listed transitive changes, with no other unrelated package changes.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Essentials
• Run ID: cfa5f1ac-269f-46b0-bce4-25fd1eadd705

Commits

Reviewing files that changed from the base of the PR and between 151d688 and 10caed3.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 2

• .cargo/audit.toml
• crates/gitlawb-node/Cargo.toml

Files with no reviewable changes: 1

• .cargo/audit.toml

Included review availability: This review used your included allowance. 3 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

[jatmn]

🟢 Thanks for the contribution. I do not see any actionable code defects in this diff on head 10caed38.

Merge readiness

• Branch freshness: Merge-base matches current main (151d688); no rebase required at review time.
• Required CI: Several PR Checks jobs were still in progress when this review was drafted (fmt + clippy, test (stable|beta), build --release, MSRV, Docker smoke, CodeQL rust/swift). cargo audit already passed on GitHub; local cargo audit, cargo fmt --check, and cargo clippy --locked --workspace --all-targets -- -D warnings also passed in the review checkout.
• Scope: Single commit, three files — aligns with #76 and Dependabot hickory/serde_with alerts. No duplicate open PR for the same work surfaced in campaign metadata.
• Issue #76: Lockfile shows hickory-proto / hickory-resolver 0.26.3 and libp2p-dns 0.45.0; .cargo/audit.toml no longer lists RUSTSEC-2026-0118 or 0119. Simulated audit-schedule.yml drift step on head passes with ignores absent.

Needs maintainer decision

Rolling deploy vs. libp2p stack line: This PR bumps the whole libp2p 0.43 → 0.44 dependency line (including gossipsub 0.50.1 and a lockfile prost codec path) without Rust source edits. The PR body correctly notes that a live mix with peers still on the pre-bump libp2p line was not tested, while the checklist marks backward compatibility. The repo does not define an automated two-version P2P interop oracle; HTTP ref-update fallbacks partially mitigate gossip loss but do not prove Kademlia/gossipsub mesh continuity during a heterogeneous fleet.

Maintainers should decide whether to (a) treat this as a coordinated fleet upgrade (document in release/ops copy), (b) add a minimal two-node libp2p smoke test before or after merge, or (c) accept the disclosed risk for a security-only dependency bump. That choice is product/ops policy, not a defect in the three-file diff itself.

Follow-up (non-blocking): Issue #76 comment describes an audit-schedule.yml pipefail edge when hickory-proto is ever absent from Cargo.lock. Head still includes hickory-proto 0.26.3, so this PR does not trigger it; fixing the workflow assignment is reasonable future hygiene if the dependency graph later drops hickory entirely.

[Copilot]

🔵 Needs a closer look

Mixed-version interoperability remains untested across major P2P stack upgrades affecting QUIC/TLS and protobuf codecs, requiring maintainer validation of compatibility with deployed older peers.

No open issues 🎉

What changed in this PR

Updates the node’s networking dependencies to bring in patched Hickory and serde_with releases, addressing the security updates tracked in #76 without application source changes.

Changes:

• Upgrades the libp2p stack and aligns multiaddr with the newer release line.
• Updates the lockfile to Hickory 0.26.3 and serde_with 3.22.0, including required transitive changes.
• Removes the two resolved Hickory advisory suppressions while preserving unrelated ignores.

File	Description
crates/​gitlawb-node/​Cargo.toml	Upgrades libp2p dependencies and multiaddr.
Cargo.lock	Locks patched dependencies and updates the resolved dependency graph.
.cargo/​audit.toml	Removes the RUSTSEC-2026-0118 and RUSTSEC-2026-0119 ignores.

_{Review effort: Balanced}

[beardthelion]

Approving at 10caed3. The lock resolves hickory-proto, hickory-resolver and hickory-net to 0.26.3 and libp2p-quic to 0.14.0. A cargo audit run with no ignore list shows the two hickory 0.25.2 advisories and the tokio RUSTSEC-2026-0386 warning gone from base to head, with nothing added. cargo metadata --locked accepts the lock and cargo audit exits 0 with the repo config.

The cross-version gap the description lists is covered. A libp2p-identity 0.2.13 and 0.3.1 comparison over six seeds, including the node's DefaultHasher-of-DID derivation, gives identical PeerIds, public keys and signatures, and each version verifies the other's signatures. A gossipsub test with the 0.43 stack and the 0.44 stack in one process over QUIC, using the node's config (Permissive validation, Signed, same message_id_fn), delivers a ref-update payload in both directions with the right signed source. Same-version controls pass, and a receiver that never subscribes gets nothing. Kademlia, Identify, and control messages over the new 16 KB cap were not run.

Non-blocking, for a follow-up: the hickory drift guard in audit-schedule.yml is now vestigial. It still passes because the ignores are gone, but it describes hickory 0.25.x. Either delete it or point it at the crypto-bigint ignore.