Repository navigation
fix(security): patch quinn-proto, rustls, rustls-webpki, tokio, tar + 5 more in Cargo.lock (24 advisories; supersedes #39) - #44
Open
benfrank241 wants to merge 1 commit into
Conversation
…nd more in Cargo.lock Lockfile-only `cargo update -p <crate> --precise <first patched>`. Superset of #39 plus advisories published since 2026-09-21. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Daily security sweep for the root
Cargo.lock(cargo). Dependabot alerts on this repo return 0 in every state, so the sweep found these advisories by auditing the lockfile against OSV / GitHub Advisory DB, and there are no alert numbers. Recommend enabling Settings → Code security → Dependabot alerts.Supersedes #39. This PR includes all of #39's bumps (bytes, quinn-proto, rand, rustls-webpki, tar), carries them further where new advisories now require it, and adds the advisories published since 2026-09-21. Once this merges, #39 can be closed. Both PRs edit only
Cargo.lock.Advisories cleared (24 unique)
Each crate went to its lowest patched version with
cargo update -p <crate> --precise <ver>.Cargo.tomlis unchanged.Expected lock churn, with the cause of each change
quinn-proto0.11.18 depends onrand 0.10, which addsrand 0.10.3,rand_core 0.10.1,rand_pcg 0.10.2,chacha20,cpufeatures 0.3.1,getrandom 0.4.3andr-efi 6. 0.11.17 would avoid this, but it leaves GHSA-465w-v9q3-7j98 and GHSA-3g6h-r5qx-f6hq open.tokio1.51.6 pullstokio-macros2.7.2 (which usessyn 3.0.9),mio1.2.4,socket20.6.5 andlibc0.2.191.event-listener5.4.2 no longer depends onconcurrent-queue, so that crate is removed.Not included (backlog)
zip = "2"(Windows-only), and the 4.6.1 copy comes frompostgresql_archive0.20, so 4.6.1 also needs an upstream release. Maintainer decision.parking_lot 0.11←reqwest-retry 0.7←postgresql_archive.Verification (from
ci.yml)cargo build --releasesucceeds.cargo test --release: 12 passed, 0 failed.x86_64-pc-windows-msvccross target locally. CI covers it.🤖 Generated with Claude Code