patch-bridge: classify Dioxus/GTK transitive advisories as Informational (Cohort E-2) #75

Context

Track E (estate-wide panic-attack bridge triage) surfaced ~100 advisories across 5 repos that were initially grouped as Cohort E-2 — GUI/Dioxus upstream tracking. After per-repo Cargo.toml + Cargo.lock inspection on 2026-05-27, the cohort breakdown is:

The 4 misclassified repos belong elsewhere — their advisories come from rustls/openssl/rand pulled by reqwest/vosk/tesseract-rs/gix/actix-http/tch, none of which are Dioxus/GTK transitives. Each Track E issue has been commented with the correct parent-dep analysis (so panic-attack's bridge can still classify them Informational via the right cohort).

The genuine E-2 case (presswerk)

Vulnerable chains, all transitive via two direct deps:

1. dioxus@0.7 → dioxus-desktop@0.7.9 → wry@0.53.5 → GTK/webkit family

   • atk@0.18.2 (RUSTSEC-2024-0413)
   • atk-sys@0.18.2 (RUSTSEC-2024-0416)
   • gdk@0.18.2 (RUSTSEC-2024-0412)
   • gdk-sys@0.18.2 (RUSTSEC-2024-0418)
   • gdkwayland-sys@0.18.2 (RUSTSEC-2024-0411)
   • gdkx11-sys@0.18.2 (RUSTSEC-2024-0414)
   • glib@0.18.5 (GHSA-wrw7-89jp-8q8g, RUSTSEC-2024-0429)
   • gtk@0.18.2 (RUSTSEC-2024-0415)
   • gtk-sys@0.18.2 (RUSTSEC-2024-0420)
   • gtk3-macros@0.18.2 (RUSTSEC-2024-0419)
   • proc-macro-error@1.0.4 (RUSTSEC-2024-0370) — gtk3-macros
   • paste@1.0.15 (RUSTSEC-2024-0436) — gtk3-macros / wry
   • fxhash@0.2.1 (RUSTSEC-2025-0057) — wry/cssparser
   • openssl@0.10.79 (GHSA-phqj-4mhp-q6mq) — wry's TLS path

2. printpdf@0.9.1 → kuchiki@0.8.1 (RUSTSEC-2023-0019) + cssparser 0.27.2 chain → rand@0.7.3 (GHSA-cq8v-f236-94qc, RUSTSEC-2026-0097) — classified reach=reachable

3. Other unrelated transitives in the same bucket: bincode@1.3.3 (RUSTSEC-2025-0141), core2@0.4.0 (RUSTSEC-2026-0105)

Request to the patch-bridge

The bridge currently emits 18 phantom-classified + 2 reachable-unmitigable. The 2 reachable hits on rand@0.7.3 are reachable only via the printpdf → kuchiki → phf_codegen (build-time) chain, which is not exploitable at runtime for a print router. Request: add a Cohort E-2 carve-out so:

1. The GTK/webkit family (atk*, gdk*, gtk*, glib, proc-macro-error, paste) — classify Informational when the immediate parent is wry/dioxus-desktop, regardless of reach. They're declared-but-untouched by the host repo's own source.
2. kuchiki@0.8.1 (RUSTSEC-2023-0019) when parent is printpdf — classify Informational (printpdf uses kuchiki for HTML→PDF parsing, internal to the crate).
3. rand@0.7.3 reachable via phf_codegen (build script transitive) — re-classify as Informational (build-time only, not runtime path).

Closure path

This issue stays OPEN until either:

1. dioxus-desktop ships a release that swaps wry→tao-only or bumps the GTK family past affected versions, AND printpdf ships a release that drops kuchiki or bumps it past 0.8.1; OR
2. presswerk swaps dioxus for an alternative (egui, slint, gpui, gossamer) AND swaps printpdf for a non-kuchiki PDF lib (lopdf alone, pdf-writer); OR
3. The patch-bridge ships the Cohort E-2 classification rule above and presswerk#40 gets closed as accepted-risk.

Cross-references

• presswerk#40 (true E-2)
• formatrix-docs#13 (misclassified — see triage comment for correct parents)
• docmatrix#21 (misclassified)
• intsoc-transactor#16 (misclassified)
• git-reticulator#10 (misclassified)
• Estate tracker: panic-attack estate sweep — 2026-05-26 #32

🤖 Filed during Track E Cohort E-2 closeout (2026-05-27).