[tjdammann]

What

The required Security Audit check fails on main (and so on every open PR) because new RustSec advisories hit four transitive dependencies. This is a lockfile-only cargo update -p quinn-proto -p rustls -p rustls-webpki -p webpki-root-certs; no Cargo.toml or code changes.

Crate	From	To	Advisories
quinn-proto	0.11.16	0.11.19	RUSTSEC-2026-0338, -0339, -0340, -0341, -0342
rustls	0.23.42	0.23.46	RUSTSEC-2026-0285, -0346, -0348, -0349
rustls-webpki	0.103.13	0.103.16	RUSTSEC-2026-0382
webpki-root-certs	1.0.9	1.0.11	RUSTSEC-2026-0383

aws-lc-rs / aws-lc-sys move along with rustls (1.17.3 → 1.19.0, 0.43.0 → 0.47.0).

Testing

cargo test and cargo clippy -- -D warnings pass locally; CI's Security Audit is the real check.

Unblocks #339.

🤖 Generated with Claude Code

[aviator-app]

Current Aviator status

Aviator will automatically update this comment as the status of the PR changes.
Comment /aviator refresh to force Aviator to re-examine your PR (or learn about other /aviator commands).

This PR is currently in state closed (PR closed manually).

---

See the real-time status of this PR on the Aviator webapp.

Use the Aviator Chrome Extension to see the status of your PR within GitHub.

[cubic-dev-ai]

No issues found across 1 file

_{View guided diff | Turn on auto-fix | Re-trigger cubic}

[tjdammann]

Folded into #339 as a separate commit: this PR can't pass Vendored Artifacts until #339's openapi.json lands, and #339 couldn't pass Security Audit without this bump.