build(deps): consolidate 18 dependency-update PRs + broader version sweep (#33)

Consolidates all 18 open dependabot PRs (#7-#32) into a single CI-verified
update, plus a broader sweep bringing every other Cargo, npm, GitHub Actions,
and submodule dependency to its latest compatible version. Also fixes real
RUSTSEC TLS/DNS vulnerabilities upstream in the prtip and wraith-protocol
submodules. See PR #33 description for full details.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: doublegate

.cargo/audit.toml

@@ -42,4 +42,13 @@ ignore = [
     "RUSTSEC-2025-0057",   # fxhash - used by HTML parsing (selectors), no known vulns
     "RUSTSEC-2025-0119",   # number_prefix - used by indicatif progress bars, cosmetic
     "RUSTSEC-2025-0141",   # bincode - used by WRAITH discovery (internal comms only)
+
+    # RUSTSEC-2026-0194/0195: quick-xml 0.38.4 quadratic runtime / memory exhaustion
+    # - Transitive: tauri 2.11.5 (latest) -> plist 1.8.0 -> quick-xml 0.38.4
+    # - Only used for macOS Info.plist bundle-metadata parsing at build/packaging time,
+    #   not attacker-reachable network input
+    # - No fix available: tauri's own `plist` dependency hasn't moved to quick-xml >=0.41.0
+    #   yet; re-check on the next tauri/plist release and remove this entry once resolved
+    "RUSTSEC-2026-0194",
+    "RUSTSEC-2026-0195",
 ]

.github/workflows/ci.yml

@@ -29,12 +29,12 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v6
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: '22'
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@v6
         with:
-          version: 9
+          version: 11
       - name: Install dependencies
         run: |
           cd crates/spectre-gui/frontend
@@ -74,12 +74,12 @@ jobs:
             libpcap-dev
 
       # Setup Node.js and pnpm for frontend
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: '22'
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@v6
         with:
-          version: 9
+          version: 11
 
       # Build frontend (required before Rust build for Tauri)
       - name: Build frontend
@@ -146,12 +146,12 @@ jobs:
           echo "LIB=${{ github.workspace }}\npcap-sdk\Lib\x64" >> $env:GITHUB_ENV
 
       # Setup Node.js and pnpm for frontend (all platforms)
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: '22'
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@v6
         with:
-          version: 9
+          version: 11
 
       # Build frontend (required before Rust build for Tauri)
       - name: Build frontend
@@ -200,12 +200,12 @@ jobs:
             libpcap-dev
 
       # Setup Node.js and pnpm for frontend
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: '22'
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@v6
         with:
-          version: 9
+          version: 11
 
       # Build frontend (required before Rust build for Tauri)
       - name: Build frontend
@@ -263,12 +263,12 @@ jobs:
             libpcap-dev
 
       # Setup Node.js and pnpm for frontend
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: '22'
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@v6
         with:
-          version: 9
+          version: 11
 
       # Build frontend (required before Rust build for Tauri)
       - name: Build frontend
@@ -312,12 +312,12 @@ jobs:
             libpcap-dev
 
       # Setup Node.js and pnpm for frontend
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: '22'
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@v6
         with:
-          version: 9
+          version: 11
 
       # Build frontend (required before Rust build for Tauri)
       - name: Build frontend
@@ -334,7 +334,7 @@ jobs:
       - name: Generate coverage
         run: cargo tarpaulin --workspace --out Xml
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v7
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./cobertura.xml

.github/workflows/gui.yml

@@ -22,11 +22,11 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
         with:
-          version: 9
+          version: 11
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: 'pnpm'
@@ -120,11 +120,11 @@ jobs:
           key: ${{ matrix.platform.target }}
           prefix-key: "v2"
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
         with:
-          version: 9
+          version: 11
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: 'pnpm'

.github/workflows/release.yml

@@ -104,7 +104,7 @@ jobs:
           Compress-Archive -Path dist/* -DestinationPath "${{ matrix.artifact }}.zip"
 
       - name: Upload Release Asset
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           files: |
             ${{ matrix.artifact }}.tar.gz
@@ -185,11 +185,11 @@ jobs:
           key: ${{ matrix.platform.target }}
           prefix-key: "v2"
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
         with:
-          version: 9
+          version: 11
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: 'pnpm'

CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Consolidated 18 open dependabot PRs (#7-#32) into a single dependency-update sweep, plus a
+  broader pass to bring every other Cargo, npm, GitHub Actions, and submodule dependency to its
+  latest compatible version.
+  - GitHub Actions: `softprops/action-gh-release` v2->v3, `pnpm/action-setup` v2/v4->v6
+    (standardized across all workflows, including pinned pnpm 9->11), `codecov/codecov-action`
+    v5->v7, `actions/setup-node` v4->v6.
+  - Cargo: `sha2` 0.10->0.11, `ipnetwork` 0.20->0.21, `toml` 0.8->1.1, `toml_edit` 0.22->0.25,
+    `quick-xml` 0.37->0.41, `rand` 0.8->0.10, `bollard` 0.18->0.21 (migrated
+    `crates/spectre-core/src/chef/docker.rs` to bollard's relocated `query_parameters`/`models`
+    API), plus transitive bumps to openssl, quinn-proto, and keccak. `rusqlite` and `mlua` remain
+    pinned (0.32, 0.11) due to a shared native-library (`sqlite3`, `lua`) version constraint with
+    the `prtip` submodule's own dependencies.
+  - npm (GUI frontend): `rollup` (transitive via vite) and other packages within existing semver
+    ranges.
+  - Submodules: `components/prtip` and `components/wraith-protocol` synced to their latest pushed
+    commits; `components/cyberchef-mcp` fast-forwarded to latest upstream master.
+- Fixed 5 pre-existing `clippy::unnecessary_sort_by` failures (`sort_by` -> `sort_by_key`) that
+  were already failing CI on the current toolchain independent of this dependency sweep.
+
 ## [0.5.0] - 2026-02-06
 
 ### Added - Sprint 5.8: Polish & Release (v0.5.0 Stable)