[Security] Track upstream-owned quick-xml 0.39.4 RustSec exceptions

[seonghobae]

Role

• 직무 / O0: v0.2 sale-readiness security diligence
• 업무 / O1: Rust desktop dependency exception lifecycle
• 과업 / O2~O3: keep quick-xml 0.39.4 RustSec exceptions narrow, auditable, and removable
• 작업 / O4~O7: owner-chain verification, upstream watch, lockfile refresh, exception removal

Current evidence

RUSTSEC-2026-0194 and RUSTSEC-2026-0195 remain because quick-xml 0.39.4 is inherited through the current Tauri/plist runtime metadata handling path and rfd/wayland-scanner build-time owner chain. Current compatible upstream crates do not yet allow quick-xml >=0.41.0.

BandScope user-facing audio import, YouTube import, project load/save, export, rehearsal role, cue, and chart data paths do not parse attacker-supplied XML through those owners. The exception must remain tied to the documented owner chain and be removed once compatible upstream crates move to a patched quick-xml version.

Acceptance criteria

• apps/desktop/src-tauri/osv-scanner.toml documents both quick-xml advisories with concrete owner and entry-point scope.
• scripts/checks/verify_supply_chain.py continues to fail closed if the exception broadens beyond the documented owner chain.
• A future compatible Tauri/plist/rfd/wayland-scanner update is tested with a lockfile refresh.
• When quick-xml >=0.41.0 is reachable through compatible upstream crates, remove the OSV exceptions and close this issue with scan evidence.

Security notes

• Untrusted inputs: no new runtime input path is introduced by this tracking issue.
• Trust boundary: XML parser exposure is limited to upstream desktop framework metadata/build-time owner paths, not BandScope user content parsing.
• Safe failure: supply-chain policy checks should fail closed on unexpected owners or advisory drift.
• Test points: python3 scripts/checks/verify_supply_chain.py, npm run check:security-notes, and desktop Vitest coverage for affected UI changes.

Blocked-by: compatible Tauri/plist/rfd/wayland-scanner dependency chain allowing quick-xml >=0.41.0.

[seonghobae]

@opencode-agent Implement this issue now on a fresh BandScope branch from current protected develop@acdbea6344fe1231c39535b575f4de35e4c607c9; do not touch central .github or other repositories. Apply superpowers:using-superpowers, systematic-debugging, test-driven-development, and verification-before-completion.

Fresh owner-chain evidence changes the issue's former blocked condition: protected Cargo.lock already has plist 1.10.0 -> quick-xml 0.41.0; the remaining vulnerable quick-xml 0.39.4 is owned by wayland-scanner 0.31.10. The authoritative crates.io index now publishes non-yanked wayland-scanner 0.31.11 (2026-07-22), same Rust 1.71 requirement, with quick-xml ^0.41; checksum 338e30461b3a2b67d70eb30a6d89f8e0c93a833e07d2ae89085cd070c4a00ac0.

Use TDD: first add the smallest realistic regression that fails on the current base because (a) any locked quick-xml is below 0.41, (b) wayland-scanner is below 0.31.11, or (c) the retired advisory IDs remain in cargo-audit/OSV exceptions. Then perform the minimal transitive Cargo lock refresh to wayland-scanner 0.31.11, eliminate unreachable quick-xml 0.39.4, remove RUSTSEC-2026-0194 and RUSTSEC-2026-0195 from both apps/desktop/src-tauri/.cargo/audit.toml and apps/desktop/src-tauri/osv-scanner.toml, retire stale exception documentation, and update CHANGELOG.md/dependency-policy truth. Do not weaken a gate or retain a stale allowlist.

Verify the exact head with focused regression, cargo check/test --locked as applicable, cargo audit, OSV/supply-chain verification, security-notes validation, and full repository checks. Create or update exactly one PR to develop, reference #542, and do not merge without live required checks plus qualifying independent approval. Before every write refetch the target head/base/blob and adapt to concurrent movement rather than force-pushing.