[mostafa]

Summary

• Rolls up all six open Dependabot PRs (build(deps): bump debian from 5bc3287 to eb593cf in /crates/rsigma-convert/tests/engines/lynxdb #570 through build(deps): bump the actions-updates group with 5 updates #575) plus the updates Dependabot has queued behind its five-PR limit for root Cargo, so merging this does not immediately spawn another round. Both Cargo lockfiles are regenerated against current main.
• Security: rustls 0.23.45 to 0.23.46 in Cargo.lock and fuzz/Cargo.lock for RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349. These are why cargo audit and cargo deny fail on every open Cargo PR. fuzz/Cargo.lock, which CI does not audit, also had quinn-proto 0.11.16 (RUSTSEC-2026-0338 through RUSTSEC-2026-0342) and a yanked chacha20 0.10.1; both now match the root lockfile.
• Rust, from the open PRs: the patch group with tokio 1.53.2, zeroize 1.9.1, rmcp 3.5.1, and toml 1.1.8 (build(deps): bump the patch-updates group with 4 updates #573), insta 1.49.0 (build(deps): bump insta from 1.48.0 to 1.49.0 #574), and arbitrary 1.5.0 in the fuzz crate (build(deps): bump arbitrary from 1.4.2 to 1.5.0 in /fuzz #571).
• Rust, queued updates past the 7-day cooldown: cel 0.14 to 0.15, jsonschema 0.56 to 0.58, hyper 1.12.0, uuid 1.27.0, and pest 2.9.3. Both breaking bumps build without code changes. cel 0.15 tightens CEL spec conformance, which changes a few type: cel extract expression results; the changelog lists them. The docs now name the cel crate instead of its old cel-interpreter name.
• CI: taiki-e/install-action v2.87.26, actions/upload-artifact v7.0.2, actions/download-artifact v8.0.2, github/codeql-action/upload-sarif v4.38.3, and actions/setup-node v7.1.0, pinned by full commit SHA (build(deps): bump the actions-updates group with 5 updates #575).
• VS Code: @types/node 26.6.4 (build(deps-dev): bump @types/node from 26.6.3 to 26.6.4 in /editors/vscode in the npm-updates group #572).
• Backend engine tests: new debian:stable-slim digest for LynxDB (build(deps): bump debian from 5bc3287 to eb593cf in /crates/rsigma-convert/tests/engines/lynxdb #570), a new python:3.13-slim digest for pySigma, and markupsafe 3.0.4 recompiled with uv pip compile --generate-hashes.
• Versions released within the cooldown are not taken (tokio 1.53.3, uuid 1.28.0, pest 2.9.4, @types/node 26.6.5), except rustls for the advisories.
• Held back: yamlpath/yamlpatch 1.30.1 (chore(deps): bump yamlpath from 1.27.0 to 1.30.1 #495, chore(deps): bump yamlpatch from 1.26.1 to 1.30.1 #494) require rustc 1.97 through tree-sitter-iter, above the 1.96.0 MSRV. tikv-jemallocator 0.7.0 (chore(deps): bump tikv-jemallocator from 0.6.1 to 0.7.0 #425) remains excluded after the measured musl daemon throughput regression. testcontainers 0.28.0 waits for a testcontainers-modules release; 0.15 still requires testcontainers 0.27.

Closes #570, closes #571, closes #572, closes #573, closes #574, closes #575.

Test plan

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo doc --workspace --all-features --locked --no-deps
• cargo test --workspace --all-features --locked (4392 tests pass)
• cargo check --locked in fuzz/
• cargo audit on both lockfiles and cargo deny check
• zizmor --pedantic .github/workflows
• python3 scripts/mcp-smoke.py over stdio and --http
• VS Code extension: npm ci, npm run compile, and tsc --noEmit
• pySigma engine image builds
• npm run docs:build and npm run docs:validate
• CI green on all platforms