Track RUSTSEC-2026-0185 in quinn-proto

[lodyai]

Summary

make audit reports RUSTSEC-2026-0185 for quinn-proto 0.11.14:
remote memory exhaustion in unbounded out-of-order stream reassembly.

Current state

• RustSec advisory: https://rustsec.org/advisories/RUSTSEC-2026-0185
• Reported version: quinn-proto 0.11.14
• Suggested fixed version: quinn-proto >=0.11.15
• Cargo.lock also contains quinn 0.11.9, which depends on
  quinn-proto.

cargo tree --target all -i quinn-proto@0.11.14 did not print an active
feature path in the current local graph, but cargo audit still scans the
locked crate and fails the audit gate.

Acceptance criteria

• Refresh the lockfile or direct dependency constraints so Cargo.lock no
  longer contains vulnerable quinn-proto 0.11.14.
• Remove the temporary RUSTSEC-2026-0185 audit suppression from Makefile.
• Run make audit and the normal commit gates successfully.

[coderabbitai]

🔗 Related PRs

leynos/corbusier#79 - Add joint Rust and node audit gate [merged]
leynos/podbot#115 - Address code-base audit findings [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!