fix(deps): remediate trading security alerts

.cargo/audit.toml

@@ -1,42 +1,21 @@
-# Known advisories in transitive dependencies from the Blueprint SDK,
-# Sandbox runtime, and the ethers-v2 stack used by Hyperliquid.
-# These are not direct deps of ai-trading-blueprint.
-#
-# Each ID is matched 1:1 with deny.toml's [advisories].ignore list and
-# documented in audits/static-analysis-triage.md. Re-evaluate quarterly
-# (first Monday of each quarter) or when a fix lands upstream.
+# Current transitive advisories that cannot be removed by this workspace.
+# Dependency paths and applicability are kept in the static-analysis triage.
 
 [advisories]
 ignore = [
-    # ── substrate / blueprint-sdk transitive ────────────────────────────────
-    "RUSTSEC-2021-0141", # ansi_term unmaintained (via substrate)
-    "RUSTSEC-2024-0384", # instant unmaintained (via substrate)
-    "RUSTSEC-2024-0388", # derivative unmaintained (via Alloy/ruint)
-    "RUSTSEC-2024-0436", # paste unmaintained (via substrate)
-    "RUSTSEC-2025-0009", # ring < 0.17.12 panic (via substrate)
-    "RUSTSEC-2025-0010", # ring < 0.17 unmaintained (via substrate)
-    "RUSTSEC-2025-0012", # ring transitive (via substrate)
-    "RUSTSEC-2025-0055", # tracing-subscriber 0.2 ANSI escape (via substrate)
-    "RUSTSEC-2025-0111", # tokio-tar PAX header (testcontainers, dev-only)
-    "RUSTSEC-2025-0134", # rustls-pemfile unmaintained (via substrate)
-    "RUSTSEC-2025-0141", # bincode 1.x unmaintained (via substrate / solana)
-    "RUSTSEC-2025-0161", # libsecp256k1 unmaintained (via blueprint-networking)
-    "RUSTSEC-2026-0002", # lru IterMut Stacked Borrows (via substrate)
-    "RUSTSEC-2026-0044", # aws-lc-sys < 0.39.0 (via substrate)
-    "RUSTSEC-2026-0048", # aws-lc-sys < 0.39.0 (via substrate)
-    "RUSTSEC-2026-0049", # substrate transitive
-    "RUSTSEC-2026-0067", # substrate transitive
-    "RUSTSEC-2026-0068", # substrate transitive
-    "RUSTSEC-2026-0097", # rand 0.7 unsoundness (via substrate)
-    "RUSTSEC-2026-0098", # rustls-webpki name constraints (via substrate)
-    "RUSTSEC-2026-0099", # rustls-webpki wildcard names (via substrate)
-    "RUSTSEC-2026-0104", # rustls-webpki CRL parser panic (via substrate)
-    "RUSTSEC-2026-0118", # transitive (via substrate)
-    "RUSTSEC-2026-0119", # hickory-proto O(n²) (via substrate)
-    "RUSTSEC-2026-0173", # proc-macro-error2 unmaintained (compile-time, via alloy-sol-macro)
-    # ── sandbox-runtime TEE attestation transitive ──────────────────────────
-    "RUSTSEC-2023-0071", # rsa Marvin timing — verify-only (RSA-PSS attestation sig verification in sandbox-runtime tee-verify); no private-key decryption; no upstream fix
-    # ── ethers-v2 and remaining upstream transitive dependencies ─────────────
-    "RUSTSEC-2025-0057", # fxhash unmaintained (via ethers-providers v2)
-    "RUSTSEC-2021-0145", # atty unaligned read (via solana-logger)
+    # Vulnerabilities with no consumable fixed path.
+    "RUSTSEC-2023-0071", # rsa: verify-only TEE attestation path; no fixed release
+    "RUSTSEC-2025-0055", # tracing-subscriber 0.2: inactive lock-only Ark dependency
+    "RUSTSEC-2025-0111", # tokio-tar: testcontainers dev path; no fixed release
+    "RUSTSEC-2026-0118", # hickory-proto: inactive lock-only libp2p dependency; no fix
+    "RUSTSEC-2026-0119", # hickory-proto: inactive lock-only libp2p dependency
+
+    # Unmaintained upstream transitive packages.
+    "RUSTSEC-2021-0141", # dotenv
+    "RUSTSEC-2024-0388", # derivative
+    "RUSTSEC-2024-0436", # paste
+    "RUSTSEC-2025-0134", # rustls-pemfile
+    "RUSTSEC-2025-0141", # bincode 1
+    "RUSTSEC-2025-0161", # libsecp256k1
+    "RUSTSEC-2026-0173", # proc-macro-error2
 ]

.github/workflows/ci.yml

@@ -302,36 +302,8 @@ jobs:
 
       - uses: Swatinem/rust-cache@v2
 
-      # Ignore known transitive advisories from blueprint-sdk -> substrate deps.
-      # These come through libp2p, ring, aws-lc-sys, and legacy rustls stacks
-      # pulled in via Blueprint git dependencies; tracked upstream.
       - name: Run audit
-        run: |
-          cargo audit \
-            --ignore RUSTSEC-2021-0141 \
-            --ignore RUSTSEC-2024-0384 \
-            --ignore RUSTSEC-2024-0388 \
-            --ignore RUSTSEC-2024-0436 \
-            --ignore RUSTSEC-2025-0009 \
-            --ignore RUSTSEC-2025-0010 \
-            --ignore RUSTSEC-2025-0012 \
-            --ignore RUSTSEC-2025-0055 \
-            --ignore RUSTSEC-2025-0111 \
-            --ignore RUSTSEC-2025-0134 \
-            --ignore RUSTSEC-2025-0141 \
-            --ignore RUSTSEC-2025-0161 \
-            --ignore RUSTSEC-2026-0002 \
-            --ignore RUSTSEC-2026-0044 \
-            --ignore RUSTSEC-2026-0048 \
-            --ignore RUSTSEC-2026-0049 \
-            --ignore RUSTSEC-2026-0067 \
-            --ignore RUSTSEC-2026-0068 \
-            --ignore RUSTSEC-2026-0097 \
-            --ignore RUSTSEC-2026-0098 \
-            --ignore RUSTSEC-2026-0099 \
-            --ignore RUSTSEC-2026-0104 \
-            --ignore RUSTSEC-2026-0118 \
-            --ignore RUSTSEC-2026-0119
+        run: cargo audit -D warnings
 
   # ── Evals (TypeScript) ────────────────────────────────────────────────────
   evals:

.github/workflows/static-analysis.yml

@@ -140,11 +140,8 @@ jobs:
       - name: Install cargo-audit
         run: cargo install cargo-audit --locked
 
-      # Reads .cargo/audit.toml for the ignore list. Every entry there
-      # is cross-referenced in deny.toml's [advisories].ignore and in
-      # audits/static-analysis-triage.md. `-D warnings` denies on
-      # unmaintained / unsound / yanked; whitelisted IDs cover known
-      # transitive deps (substrate / solana-sdk / ethers-v2).
+      # Reads .cargo/audit.toml. `-D warnings` also checks unmaintained,
+      # unsound, and yanked packages.
       - name: Run cargo audit
         run: cargo audit -D warnings