GeezerVison

Clear every RustSec advisory in src/crates on the v2.12 release branch, starting with the eMudhra/emSign distrusted intermediates, so the next patch release ships them. Part of #24662; the master side is #24686.

Previously: v2.12.3 locks rustls-webpki 0.103.13, so otel-plugin and netflow-plugin accept TLS chains through the compromised eMudhra intermediates, and cargo audit on the branch reports 24 vulnerabilities plus unsound and yanked crates. The master fixes (#24393 and the #24686 lockfile commits) do not cherry-pick: the v2.12 lockfile has drifted and every attempt conflicts. Now: the same fixes, rebuilt on v2.12 and pinned to the versions master already uses.

• eMudhra/emSign (first commit, cherry-picks on its own): rustls-webpki 0.103.16 (RUSTSEC-2026-0382) blocklists the compromised intermediate keys; webpki-roots 1.0.10 (RUSTSEC-2026-0381) and webpki-root-certs 1.0.12 (RUSTSEC-2026-0383) cover the bundled roots, which are not shipped on Linux. rustls-webpki 0.103.16 requires aws-lc-rs 1.18, so aws-lc-rs 1.18.1 and aws-lc-sys 0.45.0 come along; master already uses both.
• Other lockfile-only fixes: rustls 0.23.46, h2 0.4.19, quinn-proto 0.11.18, chacha20 0.10.2 (0.10.1 is yanked), ctutils 0.4.8, pulldown-cmark 0.13.6, ruzstd 0.9.1, zstd 0.13.4 with zstd-safe 7.4.0 and zstd-sys 2.1.2, tokio 1.54.1, event-listener 5.4.2, lru 0.18.4.
• Manifest bumps (same as master): lru 0.16 → 0.19 (unsound RUSTSEC-2026-0253); ruzstd 0.8 → 0.9.1 for journal-core's zstd decoder (RUSTSEC-2026-0344); opendal 0.57 → 0.59 for quick-xml 0.42 (RUSTSEC-2026-0194, -0195), with the opendal and reqsign crates pinned to master's versions. The only source change is dropping .finish() in a file-lifecycle test. That test file is not rustfmt-formatted on v2.12; the commit changes one line and leaves the rest as is.
• Validation: v2.12 has no Rust CI, so everything ran locally on Rust 1.91. cargo test --workspace (excluding netflow-plugin and netipc) passes after the first, second and last commit (106 suites, 1757 tests), and otel-plugin and netflow-plugin build. A reqwest client built from this lockfile rejects the disclosure's test host dv-g3b-emudhra.we-have-a-problem.com with CertDistrusted and verifies a normal site. ruzstd 0.9.1 decoded every zstd object in 266 local system journal files (31,102 objects, no failures). cargo deny check advisories (unsound checked for all crates, yanked denied) and cargo audit --deny warnings pass, ignoring only the four vetted unmaintained advisories (bincode, fxhash, paste, unsafe-libyaml).
• Release: the series applies cleanly on top of the 2.12.4 release PR (Patch release 2.12.4 #24679), and so does the first commit alone.

Summary by cubic

Clears every RustSec advisory in src/crates on the v2.12 branch, starting with the eMudhra/emSign distrust, so the next patch release rejects TLS chains through the compromised intermediates and cargo audit passes. The master fixes don't cherry-pick because the v2.12 lockfile has drifted, so this rebuilds them on the branch, pinned to master's versions.

• rustls-webpki 0.103.16 blocklists the compromised eMudhra/emSign keys; webpki-roots and webpki-root-certs follow, and aws-lc-rs/aws-lc-sys bump to satisfy the new requirement. The stale Cargo.toml comment pinning the old aws-lc versions is removed.
• Lockfile-only fixes cover rustls, h2, quinn-proto, chacha20, ctutils, pulldown-cmark, ruzstd, zstd, tokio, event-listener, and lru.
• Manifest bumps: lru 0.16 → 0.19 (unsound), ruzstd 0.8 → 0.9.1 (unbounded decompression), opendal 0.57 → 0.59 (quick-xml 0.42); the only source change drops .finish() in a file-lifecycle recovery test.

Validation

• v2.12 has no Rust CI, so all testing ran locally on Rust 1.91: cargo test --workspace passes (106 suites, 1757 tests), and a reqwest client built from this lockfile rejects the disclosure's test host with CertDistrusted while verifying normal sites.
• cargo audit --deny warnings and cargo deny check advisories pass, ignoring only four vetted unmaintained advisories.
• The series applies cleanly on top of the 2.12.4 release PR.

^{Written for commit bd6884a. Summary will update on new commits.}