[alangou]

Summary

Update vulnerable Rust dependencies and replace the unmaintained rustls-pemfile parser. This fixes the pulldown-cmark failure in cargo deny check and removes seven of the eight advisory exceptions from deny.toml.

Related Issue

No separate issue: dependency/build fix for cargo deny check failing on RUSTSEC-2026-0414.

Changes

• Update pulldown-cmark to 0.13.5, anyhow to 1.0.104, and crossbeam-epoch to 0.9.21.
• Set the VM driver's zstd requirement to 0.14, with Cargo.lock resolving zstd 0.14.3 and zstd-safe 8.2.0. This removes the older vulnerable versions and resolves three ignored advisories.
• Select SPIFFE's supported AWS-LC JWT verification backend, removing vulnerable crypto-bigint 0.5.5 and unused legacy RustCrypto dependencies.
• Replace rustls-pemfile with Rustls' native PEM API across the workspace, examples, and tests. Keep rejection of non-certificate blocks in strict CA bundle readers.
• Refresh all affected secondary lockfiles and document SPIFFE's crypto backend boundary.

The only remaining exception is RUSTSEC-2023-0071 (RSA Marvin): russh/ssh-key and RSA test fixtures still require affected versions, and RustSec lists no patched release. Update its explanation to reflect the actual dependency paths.

Release Notes

Testing

• cargo deny --locked check: passes advisories, licenses, bans, and sources; existing duplicate-version warnings remain.
• After setting the manifest requirement to 0.14, locked metadata resolution and the full cargo-deny check still pass with an unchanged Cargo.lock.
• Clippy with -D warnings passes for all root workspace targets, the V8 example, all default E2E targets, and the modified service test with e2e-docker enabled.
• All 11 tracked lockfiles pass check-cargo-lockfiles.sh; the lockfile alignment check passes.
• Formatting checks pass for the root, E2E, and V8 workspaces.
• 3,615 tests pass across openshell-core, openshell-sandbox-backend, openshell-sandbox, openshell-supervisor-network, openshell-cli, and openshell-driver-vm (9 pre-existing skipped tests). Run with /usr/sbin in PATH and TMPDIR=/var/tmp for the local ext4 tools and Git-discovery fixtures.
• 132 focused server tests pass: TLS/mTLS, strict CA bundle validation, JWT issuance, edge tunnel authentication, and SPIFFE signature/audience/expiry verification.
• New regression tests cover SPIFFE JWT verification and extraction of a zstd-compressed OCI layer.
• Docker service_bearer_passthrough E2E passes using freshly built sandbox/supervisor images and gateway/CLI binaries from this branch.

The broader E2E --all-targets --features e2e-docker lint check reports existing errors in untouched edge_tunnel_e2e.rs, policy_activation.rs, and websocket_conformance.rs (naming/docs, duration units, casts/formatting, and a mutex guard held across awaits). Those unrelated files are outside this dependency fix.

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied, but pull-request/5030 does not exist yet. A maintainer needs to comment /ok to test 8144168ace03443d2a7f05ae30dc844c2552ebcf to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[alangou]

/ok to test 8144168

[alangou]

/ok to test 9dcf456