cargo audit shows vulnerability in tendermint-light-node (hyper v0.12.35)

[thanethomson]

Steps to reproduce

> cargo audit

...

Crate:         hyper
Version:       0.12.35
Title:         Multiple Transfer-Encoding headers misinterprets request payload
Date:          2021-02-05
ID:            RUSTSEC-2021-0020
URL:           https://rustsec.org/advisories/RUSTSEC-2021-0020
Solution:      Upgrade to >=0.14.3 OR >=0.13.10, <0.14.0
Dependency tree: 
hyper 0.12.35

...

It seems like this is due to the dependency on jsonrpc-http-server in the Light Node:

> cargo tree -i hyper:0.12.35
hyper v0.12.35
└── jsonrpc-http-server v14.2.0
    └── tendermint-light-node v0.18.0

What's the definition of "done" for this issue?

When cargo audit gives us a clean bill of health.