[mostafa]

Combines the remaining open Dependabot PRs into a single branch so they can be reviewed, tested, and merged together. Each upstream PR is preserved as its own commit (authored by dependabot[bot]), plus reconciliation commits for python/Cargo.lock, the hickory family, core.wasm, and the Security Audit CVEs that those bumps surfaced.

Bot core.wasm rebuilds on the individual PRs are skipped. Those binaries had no matching Rust source change.

Included updates

GitHub Actions (ci-actions group, #65)

• actions/checkout 7.0.0 -> 7.0.1
• actions/setup-go 6.5.0 -> 7.0.0
• Swatinem/rust-cache 2.9.1 -> 2.9.2
• astral-sh/setup-uv 8.3.2 -> 9.0.0
• actions/setup-python 6.3.0 -> 7.0.0

Rust (rust-deps group, #70)

• serde 1.0.228 -> 1.0.229
• serde_json 1.0.150 -> 1.0.151
• thiserror 2.0.19 -> 2.0.20
• ipnet 2.12.0 -> 2.12.2
• hickory-resolver 0.26.1 -> 0.26.2 (then 0.26.3 in reconciliation)
• testcontainers 0.27.3 -> 0.28.0
• http 1.4.2 -> 1.5.0

Go go-native/ressrf (#66, then audit follow-up)

• golang.org/x/crypto 0.54.0 -> 0.56.0
• language version 1.25.0 / toolchain 1.25.12 -> 1.26.6

Go go/ressrf (#67, then audit follow-up)

• golang.org/x/crypto 0.54.0 -> 0.56.0
• go 1.26.5 -> 1.26.6

Node (node-deps group, #69)

• tsx 4.23.0 -> 4.23.13
• @types/node 26.1.1 -> 26.4.1
• @types/ssh2 1.15.5 -> 1.15.6

Python

• cryptography 48.0.1 -> 50.0.0 (chore(deps): bump cryptography from 48.0.1 to 50.0.0 in /python #60)
• anyio 4.13.0 -> 4.14.2 (chore(deps): bump anyio from 4.13.0 to 4.14.2 in /python #73)

Reconciliation

• #65 conflicted with the core.wasm input skip from feat(go-native): let callers accept "--" host labels #72. Kept the skip and applied the rust-cache 2.9.2 pin on that job.
• python/Cargo.lock re-resolved to serde 1.0.229 and serde_json 1.0.151 so the Python extension lockfile matches the workspace bump from chore(deps): bump the rust-deps group across 1 directory with 7 updates #70.
• hickory-resolver 0.26.2 from chore(deps): bump the rust-deps group across 1 directory with 7 updates #70 does not compile against hickory-proto / hickory-net 0.26.1. Moved the family to 0.26.3.
• core.wasm rebuilt after the Rust dependency bumps and copied to go/ressrf/core.wasm and node/core.wasm.
• Security Audit was red on the combined lockfiles:
  • h2 0.4.14 -> 0.4.19 (RUSTSEC-2026-0258)
  • rustls 0.23.40 -> 0.23.45 (RUSTSEC-2026-0285)
  • golang.org/x/crypto 0.55.0 -> 0.56.0 (GO-2026-6354, GO-2026-6355)
  • both Go modules pinned to 1.26.6 for the stdlib fixes in crypto/tls, encoding/asn1, and net/http
  • native port's documented minimum is now Go 1.26+ because x/crypto 0.56.0 requires it
  • govulncheck install uses GOTOOLCHAIN=auto so setup-go's GOTOOLCHAIN=local does not block installing the latest scanner

Test plan

All four ecosystems were built and tested locally on macOS arm64:

• Rust workspace: cargo test --workspace --all-features --locked -> 174 passed, 3 ignored; cargo fmt --check clean
• Local clippy is older than CI's unpinned stable and flags clippy::unused_async_trait_impl as unknown. That allow stays from feat(go-native): let callers accept "--" host labels #72 and is valid on current stable.
• WASM crate: rebuilt via build_wasm.sh + wasm-opt + wasm-tools strip, committed
• Go (go/ressrf): go test ./..., go vet -> 209 passed; govulncheck ./... clean
• Go (go-native/ressrf): go test ./..., go vet -> 439 passed; govulncheck ./... clean
• cargo audit clean of vulnerabilities (existing anyhow unsound and chacha20 yanked warnings only)
• Python: uv lock --check, uv run maturin develop, uv run pytest -> 45 passed, 6 skipped
• Node: npm ci, tsc --noEmit, tsx --test -> 206 passed
• Tier 2 e2e: cargo test --features e2e -p ressrf-tcp --test ssrf_e2e --locked -> 11 passed

Closes #73, #70, #69, #67, #66, #65, #60.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ mostafa
❌ github-actions[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}