Repository navigation
fix(deps): update crates for RUSTSEC-2026-0381..0385 and ignore 0387 - #366
Merged
Merged
Conversation
![ferrfleet-interne[bot]](https://avatars.githubusercontent.com/in/5311663?s=60&v=4){kind=small}
There was a problem hiding this comment.
The lockfile bumps look right: rustls-webpki, webpki-roots, webpki-root-certs and ctutils are patch-level and move to the versions named in the description.
- Blocking: the new
deny.tomlignore entry goes against the policy written in the comment just above it. See the inline comment. - Nit: the title says 0381..0385, but neither the body nor the diff mentions RUSTSEC-2026-0384. The ignored advisory, 0387, also falls outside that range. Please list 0384, or say why it doesn't apply, and correct the title.
- Nit: errno, rustix, socket2, rustls-platform-verifier and one other crate move from windows-sys 0.52 to 0.61.2. That is incidental re-resolution and not covered by the description. It is harmless, but please mention it.
CI / Test and Cargo Security were still running when I reviewed.
BryanFRD
changed the title
There was a problem hiding this comment.
The blocking deny.toml policy finding is fixed in 8e5f242. The reworded comment now covers the 0387 entry. The PR description now covers both earlier nits: RUSTSEC-2026-0384 doesn't apply because Kit is on tokio 1.53.3, and the windows-sys re-resolution is listed.
CI / Test and Cargo Security were still running when I reviewed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lockfile bumps to patched versions:
RUSTSEC-2026-0387 (crypto-bigint 0.5.5, fixed in >=0.7.6) has no compatible upgrade: it is pinned by elliptic-curve 0.13 via p256/p384 in jsonwebtoken. Added to the deny.toml ignore list next to RUSTSEC-2023-0071, tracked in #260.
RUSTSEC-2026-0384 (tokio, patched in >=1.54.1) does not apply: it only affects tokio >=1.54.0 and Kit resolves 1.53.3, so no change was needed.
The lockfile refresh also re-resolved windows-sys 0.52 -> 0.61.2 for errno, quinn-udp, rustix, rustls-platform-verifier and winapi-util. Incidental, no advisory attached.
Checked with cargo audit, cargo deny check advisories and cargo check --workspace --all-targets. No manifest changes, so consumers only pick this up by refreshing their own lockfiles.