fix(ci): bump rustls to 0.23.46 and expire the h2 audit exception

.cargo/audit-expiries

@@ -0,0 +1,3 @@
+# UTC expiry for each cargo-audit ignore. ci-preflight fails on this date.
+# .cargo/audit.toml cannot store the date; cargo-audit rejects unknown fields.
+RUSTSEC-2026-0258 2027-01-15

.cargo/audit.toml

@@ -0,0 +1,10 @@
+# RUSTSEC-2026-0258 (h2 0.3.27) has no fixed 0.3 release.
+# The libsql remote connector only offers HTTP/1.1 (src/remote_https.rs,
+# enforced by https_client_config_advertises_http11_alpn), so the h2 0.3
+# code path never runs. Upstream fix: tursodatabase/libsql#2224.
+# Tracked in #349. Expiry UTC date is in `.cargo/audit-expiries` (2027-01-15);
+# ci-preflight fails on that date until the exception is removed or re-reviewed.
+# Every ignored advisory needs an expiry line there; cargo-audit cannot store dates.
+
+[advisories]
+ignore = ["RUSTSEC-2026-0258"]

AGENTS.md

@@ -249,8 +249,11 @@ workspace test runs only the in-process smoke), the API build without default fe
 and ordinary main pushes ignore reported CVE advisories but still fail when
 `cargo audit` cannot run). `npm audit --prefix tools/eslint --audit-level=high`
 always fails the `frontend` group on a high or critical advisory and on an
-advisory-endpoint failure. There is no fail-open switch and no ignore list;
-an unfixable transitive advisory is handled by pinning or dropping that package. GitHub-hosted Dependabot Updates dynamic workflows
+advisory-endpoint failure. There is no fail-open switch for cargo-audit; the only
+cargo-audit ignore is `RUSTSEC-2026-0258` in `.cargo/audit.toml` (see #349).
+Its UTC expiry is in `.cargo/audit-expiries` (2027-01-15); every ignored
+advisory needs an expiry line there. Any other unfixable transitive advisory is
+handled by pinning or dropping that package. GitHub-hosted Dependabot Updates dynamic workflows
 are not CI; do not add `.github/workflows` for them. Keep **Dependabot on self-hosted runners** disabled. This repository has no GitHub Actions self-hosted
 runners; otherwise jobs queue on a `dependabot` label and GitHub cancels
 them after 24 hours. Do not register leftover Proxmox GHA runners or label

deny.toml

@@ -1,5 +1,6 @@
 # Supply-chain policy for cargo-deny (licenses, bans, sources).
-# Advisories are not part of this file. GitHub Actions runs cargo-audit:
+# Advisories are not part of this file; the single cargo-audit exception is
+# `.cargo/audit.toml`. GitHub Actions runs cargo-audit:
 # pull requests and ordinary main pushes do not fail the supply-chain check on a new
 # CVE advisories on the fail-open path; cargo-audit operational failures still fail the job.
 # Scheduled builds fail closed so the advisory is visible.

docs/CI.md

@@ -65,7 +65,12 @@ Both npm audits fail on high/critical findings or endpoint errors, including
 `npm audit --prefix tools/eslint --audit-level=high`. Cargo advisory reports remain
 non-blocking for PRs/ordinary main pushes; operational audit failures always fail.
 Scheduled runs set `JMODGUARD_AUDIT_FAIL_CLOSED=1`, run all gates, and withhold
-Nightly publication when an advisory is outstanding.
+Nightly publication when an advisory is outstanding. `RUSTSEC-2026-0258` is the
+one ignored cargo-audit advisory (see #349); its UTC expiry is in
+`.cargo/audit-expiries` (2027-01-15). Every ignored advisory needs an expiry
+there; any other unfixable advisory is handled by pinning or dropping that
+package. Preflight fails on the expiry date while the ignore remains. Scheduled
+runs still fail closed on every other advisory.
 
 ## Publication and trust
 

scripts/ci-preflight-test.sh

@@ -170,3 +170,5 @@ if [ -f "$install_log" ]; then
 fi
 
 echo 'ci-preflight test: ensure_cargo_tool selection verified'
+
+bash "$root/scripts/ci-preflight.sh" --audit-expiry-self-check