[mostafa]

Summary

• Rolls up the six open Dependabot PRs that are not held back (chore(deps): bump markdown-it from 14.3.2 to 14.3.3 in /docs #628, chore(deps-dev): bump @types/node from 26.6.4 to 26.6.5 in /editors/vscode in the npm-updates group #630, chore(deps): bump serde_json from 1.0.151 to 1.0.154 in /fuzz in the patch-updates group #631, chore(deps): bump uuid from 1.27.0 to 1.28.0 #636, build(deps): bump the actions-updates group across 1 directory with 5 updates #639, build(deps): bump the patch-updates group across 1 directory with 14 updates #640) plus the updates Dependabot has queued behind its five-PR limit for root Cargo. Cargo.lock, fuzz/Cargo.lock, and ci/wasm-smoke/Cargo.lock are regenerated against current main.
• Security: rustls-webpki 0.103.16 (RUSTSEC-2026-0382) and webpki-roots 1.0.11 (RUSTSEC-2026-0381), both about distrusted intermediates being accepted during certificate verification, webpki-root-certs 1.0.11 (RUSTSEC-2026-0383), and ctutils 0.4.5 (RUSTSEC-2026-0385), in the root and fuzz lockfiles. These are why cargo audit and cargo deny fail on every open Cargo PR, including fix: parse conditions on musl and refuse rule loads in which every rule fails #642. tokio 1.54.1 also resolves the unsound warning RUSTSEC-2026-0386.
• evtx 0.12 to 0.13 drops the unmaintained encoding crate (RUSTSEC-2021-0153), so cargo audit now reports no warnings at all. The stale note about it in deny.toml is removed. One behavior change reaches rules: Windows bool substitution values other than 0 and 1 (bitmasks in some bool fields) are kept as integers instead of being coerced to true. The changelog calls it out.
• Rust, from the open PRs: the patch group with pest 2.9.4, serde_json 1.0.154, jaq-core 3.1.2, sha2 0.11.1, opentelemetry-proto 0.33.1, and the rest of build(deps): bump the patch-updates group across 1 directory with 14 updates #640, uuid 1.29.0 (chore(deps): bump uuid from 1.27.0 to 1.28.0 #636), and serde_json 1.0.154 in the fuzz crate (chore(deps): bump serde_json from 1.0.151 to 1.0.154 in /fuzz in the patch-updates group #631).
• Rust, queued updates past the 7-day cooldown: jsonschema 0.58 to 0.60, rusqlite 0.40 to 0.41, fancy-regex 0.19 to 0.20, parking_lot 0.12 to 0.13, p12-keystore 0.3 to 0.4, and rmcp 3.7.0. All build without code changes. fancy-regex is only used to validate |re patterns during linting, so its 0.20 matching fixes do not change detection results.
• CI: Swatinem/rust-cache v2.9.3, taiki-e/install-action v2.87.30, github/codeql-action/upload-sarif v4.39.1, rust-lang/crates-io-auth-action v1.0.6, and zizmorcore/zizmor-action v0.7.1, pinned by full commit SHA (build(deps): bump the actions-updates group across 1 directory with 5 updates #639). zizmor 1.31.1, which the new action runs, reports no findings.
• VS Code: @types/node 26.6.5 (chore(deps-dev): bump @types/node from 26.6.4 to 26.6.5 in /editors/vscode in the npm-updates group #630). Docs: markdown-it 14.3.3 (chore(deps): bump markdown-it from 14.3.2 to 14.3.3 in /docs #628).
• Versions released within the cooldown are not taken (pest 2.9.5, rusqlite 0.41.1, jsonschema 0.60.2, rmcp 3.8, async-nats 0.51, tonic 0.14.9, and the October 28 debian:stable-slim and python:3.13-slim digests). The pySigma requirements have no updates outside the cooldown.
• Held back: yamlpath/yamlpatch 1.31.0 (chore(deps): bump yamlpath from 1.27.0 to 1.31.0 #635, chore(deps): bump yamlpatch from 1.26.1 to 1.31.0 #634) require rustc 1.97 through tree-sitter-iter, above the 1.96.0 MSRV. tikv-jemallocator 0.7.0 (chore(deps): bump tikv-jemallocator from 0.6.1 to 0.7.0 #425) remains excluded after the measured musl daemon throughput regression. testcontainers 0.28.0 waits for a testcontainers-modules release. reqwest 0.13 in rsigma-runtime and rsigma-mcp swaps the bundled webpki-roots trust store for the platform verifier, which changes which certificates the webhook and OTLP/HTTP sinks, HTTP enrichers, HTTP dynamic sources, and the MCP daemon client trust, so it needs its own change.

Closes #640, closes #639, closes #636, closes #631, closes #630, closes #628.

Test plan

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo doc --workspace --all-features --locked --no-deps
• cargo test --workspace --all-features --locked (4520 tests pass)
• cargo check --locked in fuzz/
• ci/wasm-smoke release build with --locked and wasmtime run --invoke run_selftest
• cargo audit on both lockfiles and cargo deny check
• zizmor --pedantic .github/workflows with 1.30.1 and 1.31.1
• python3 scripts/mcp-smoke.py over stdio and --http
• VS Code extension: npm ci, npm run compile, and tsc --noEmit
• npm run docs:build and npm run docs:validate
• CI green on all platforms