From c37ebdd0c682a58d36bca1ae4ec6a851939d05be Mon Sep 17 00:00:00 2001
From: jadamcrain <jadamcrain@gmail.com>
Date: Fri, 9 Oct 2026 15:27:52 -0700
Subject: [PATCH] Scan Cargo.lock with OSV-Scanner; bump xxhash-rust to 0.8.16

cargo-audit only reads the RustSec database, so advisories that crate
maintainers publish as GitHub security advisories can go unnoticed:
GHSA-6g2r-675j-hx59 in xxhash-rust 0.8.15 is not in RustSec. OSV covers
both. Add an OSV-Scanner job to the security workflow, with the same
triggers and the same report-parsing approach as the cargo-audit job.

Bump xxhash-rust to 0.8.16, which fixes that advisory. dnp3 was not
affected: the advisory is in the xxh3 custom-secret API, and dnp3 only
enables the xxh64 feature.
---
 .github/workflows/security-audit.yml | 45 ++++++++++++++++++++++++++++
 Cargo.lock                           |  4 +--
 2 files changed, 47 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml
index 74085e2c..06f2e7db 100644
--- a/.github/workflows/security-audit.yml
+++ b/.github/workflows/security-audit.yml
@@ -110,3 +110,48 @@ jobs:
         run: |
           echo "::error::Security vulnerabilities detected in dependencies"
           exit 1
+
+  # cargo-audit only reads the RustSec database. OSV also includes GitHub security advisories
+  # that crate maintainers publish on their repositories, which do not always reach RustSec
+  # (e.g. GHSA-6g2r-675j-hx59 in xxhash-rust).
+  osv-scanner:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      # Same approach as the audit job: run once, take the verdict from the JSON report, and
+      # report a run that produced no valid report as a tool failure, not a finding.
+      - name: Run OSV-Scanner on Cargo.lock
+        run: |
+          set +e
+          docker run --rm -v "$PWD:/src" \
+            ghcr.io/google/osv-scanner:v2.6.0@sha256:afd838850ac1a0fcc15ff4a041dc9ba11123c3f0d2666217a5f0fcf9222b55fa \
+            scan source --format json -L /src/Cargo.lock > osv.json 2> osv.err
+          status=$?
+          set -e
+          cat osv.err
+
+          # exit 0: nothing found, 1: vulnerabilities found, anything else: the run failed
+          if [ "${status}" -gt 1 ] || ! jq -e . osv.json > /dev/null 2>&1; then
+            echo "::error::osv-scanner failed to produce a report (exit ${status}); this is a tool or network failure, not a vulnerability finding"
+            exit 1
+          fi
+
+          findings=$(jq -r '.results[]?.packages[]?
+                            | "\(.package.name) \(.package.version): \([.vulnerabilities[]?.id] | join(", "))"' osv.json)
+          if [ -n "${findings}" ]; then
+            echo "${findings}"
+            echo "::error::OSV-Scanner found vulnerable dependencies"
+            exit 1
+          fi
+          echo "No vulnerable dependencies found."
+
+      - name: Upload OSV report
+        if: always() && hashFiles('osv.json') != ''
+        uses: actions/upload-artifact@v7
+        with:
+          name: osv-report
+          path: |
+            osv.json
+            osv.err
diff --git a/Cargo.lock b/Cargo.lock
index 3605ed41..00fdd641 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1925,9 +1925,9 @@ checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
 [[package]]
 name = "xxhash-rust"
-version = "0.8.15"
+version = "0.8.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdd20c5420375476fbd4394763288da7eb0cc0b8c11deed431a91562af7335d3"
+checksum = "4d93c89cdc2d3a63c3ec48ffe926931bdc069eafa8e4402fe6d8f790c9d1e576"
 
 [[package]]
 name = "zerocopy"