What #443 left that has a fix on its own line:
- joule-code-collab's MLS keying test moves to openmls 0.9.1, matching
joule-moq-mls. The old openmls 0.6 dev-dependencies were the only path to
hpke-rs 0.2.0 and hpke-rs-rust-crypto 0.2.0 (RUSTSEC-2026-0069 to 0072),
so both leave the lockfile. export_secret now takes the crypto provider.
- smart-byte-rs: h2 0.4.14 -> 0.4.20 (RUSTSEC-2026-0258).
After this, every advisory left in the workspaces needs a major-version
move or an upstream release: zip < 9, pyo3 0.28, h2 0.3 (via hf-hub),
hickory-proto 0.25 (via libp2p-mdns), quick-xml 0.37/0.39 (via
open-payments-iso20022 and plist), libcrux-kem 0.0.9 (via
hpke-rs-libcrux 0.7), rkyv 0.7 and rsa (no fix).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
1f31cf0342