Repository navigation
deps: rustls 0.23.46 in the runtime; advisories checked in CI on every lockfile - #9
Merged
Merged
Conversation
…y lockfile cargo-audit on core/Cargo.lock reported ten advisories and nothing in CI looked. Four were rustls 0.23.43 (RUSTSEC-2026-0285, -0346, -0348, -0349), the TLS stack of the runtime's HTTP client and of MQTT over TLS. 0.23.46 is the patched release of the same line; only the lock moves. Checked with the built binary: POST /connectors/test on an http-poll to https://api.github.com/zen answers GET OK, and https://expired.badssl.com/ is refused for its expired certificate. The other six are rustls 0.22.4 and rustls-webpki 0.102.8, pulled by the sync nats 0.25 client in core and in the amqp and mq connectors (amqp also uses rustls 0.22 directly for amqps://). nats 0.25 has no patched release; async-nats is the way out. .cargo/audit.toml lists them with the reason none is reachable as used here, along with idna 0.1.5 (RUSTSEC-2024-0421) from amiquip in the amqp connector. scripts/audit.sh audits every committed Cargo.lock from the repo root, since cargo-audit reads .cargo/audit.toml from the current directory only. .github/workflows/audit.yml runs it on push, on pull requests and daily. Against master's core lock it fails (RUSTSEC-2026-0285, -0348); on this branch all five locks pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
cargo auditoncore/Cargo.lockreported ten advisories, and nothing in CI runs it.POST /connectors/teston an http-poll tohttps://api.github.com/zenanswersGET OK, andhttps://expired.badssl.com/is refused for its expired certificate.scripts/audit.shaudits every committedCargo.lock(core and the four connectors) from the repo root, because cargo-audit reads.cargo/audit.tomlfrom the current directory only..github/workflows/audit.ymlruns it on push, on pull requests and daily, since advisories are published without any commit here..cargo/audit.tomlfor what has no patched release: rustls 0.22.4 and rustls-webpki 0.102.8 (six advisories) from the syncnats0.25 client in core, amqp and mq, and idna 0.1.5 from amiquip in the amqp connector. Each entry says why it is not reachable as used here. Moving to async-nats removes the six.Fail before, pass after: against master's
core/Cargo.lockthe new audit fails (RUSTSEC-2026-0285, -0348); on this branch all five locks pass.cargo test(43 passed), the 22 golden cases and the parse check of all 51 scripts pass locally.The release image (
ghcr.io/cpoder/vejas-runtime) is built fromcore/only; the connectors are not in it.🤖 Generated with Claude Code