fix: resolve rustsec advisories in dependencies

Author: franzos

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## [0.3.4] - 2026-06-01
+
+### Security
+- Resolved RustSec advisories: dropped unused `rand`, bumped `lru` to 0.16
+
 ## [0.3.3] - 2026-06-01
 
 ### Changed

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "stackpit"
-version = "0.3.3"
+version = "0.3.4"
 edition = "2021"
 description = "Lightweight, self-hosted error tracking and event monitoring"
 authors = ["Franz Geffke <mail@gofranz.com>"]
@@ -43,7 +43,7 @@ uuid = { version = "1", features = ["v4", "serde"] }
 zstd = "0.13"
 dashmap = "6"
 ipnet = "2"
-lru = "0.12"
+lru = "0.16"
 parking_lot = "0.12"
 arc-swap = "1"
 simple_hll = "0.0.4"
@@ -52,11 +52,8 @@ reqwest = { version = "0.12", features = ["json", "rustls-tls"], default-feature
 polymail = { version = "0.1", features = ["lettermint", "postmark", "sendgrid"] }
 aes-gcm = "0.10"
 base64 = "0.22"
-rand = "0.10"
-# Pin OS-backed entropy explicitly for handles / nonces / CSRF tokens, so a
-# future `rand` default-features change can't silently swap in a userspace
-# PRNG (the audit / threat model expects every secret to come straight from
-# the OS RNG).
+# OS-backed entropy for handles / nonces / CSRF tokens: every secret comes
+# straight from the OS RNG, never a userspace PRNG.
 getrandom = "0.3"
 hmac = "0.12"
 sha1 = "0.10"

Cargo.toml

@@ -6,4 +6,10 @@
 version = 2
 db-urls = ["https://github.com/rustsec/advisory-db"]
 yanked = "warn"
-ignore = []
+ignore = [
+    # rsa (via openidconnect): Marvin timing sidechannel on RSA *decryption*.
+    # We only verify RS256 id_token/JWKS signatures with the IdP's public key —
+    # no private-key decryption — so the key-recovery attack doesn't apply. No
+    # fixed rsa release exists yet.
+    "RUSTSEC-2023-0071",
+]

deny.toml

@@ -20,7 +20,7 @@ thiserror = "2"
 # RS256 JWKS validation for the MCP JWT arm + back-channel logout.
 jsonwebtoken = { version = "9", default-features = false }
 # O(1) LRU eviction for the bearer + revocation caches.
-lru = "0.12"
+lru = "0.16"
 parking_lot = "0.12"
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
 serde = { version = "1", features = ["derive"] }