Skip to content

Bump tokio for RUSTSEC-2026-0386 (unsound AsyncFd I/O safety) - #369

Merged
mheffner merged 1 commit into
rotel-dev:mainfrom
mheffner:fix-tokio-RUSTSEC-2026-0386
Oct 26, 2026
Merged

mheffner merged 1 commit into
rotel-dev:mainfrom
mheffner:fix-tokio-RUSTSEC-2026-0386

Conversation

@mheffner

Copy link
Copy Markdown
Member

Fixes RUSTSEC-2026-0386 (patched >= 1.51.6, < 1.52 or >= 1.53.3). Cargo.lock-only changes.

Root Cargo.lock (1.50.0 -> first patched 1.51.x); co-bumps are the minimum versions tokio 1.51.6 requires:

  • tokio 1.50.0 -> 1.51.6
  • tokio-macros 2.6.1 -> 2.7.0 (tokio requires ~2.7.0)
  • mio 1.0.4 -> 1.2.0 (tokio requires ^1.2.0)
  • socket2 0.6.0 -> 0.6.3 (tokio requires ^0.6.3)
  • libc 0.2.174 -> 0.2.183 (mio 1.2 requires ^0.2.183)

examples/rust_processors/async_enrichment_processor, examples/ rust_processors/trivial_processor, rotel_python_processor_sdk, rotel_rust_processor_sdk and utilities Cargo.lock:

  • tokio 1.53.1 -> 1.53.3

Fixes RUSTSEC-2026-0386 (patched >= 1.51.6, < 1.52 or >= 1.53.3).
Cargo.lock-only changes.

Root Cargo.lock (1.50.0 -> first patched 1.51.x); co-bumps are the
minimum versions tokio 1.51.6 requires:
- tokio 1.50.0 -> 1.51.6
- tokio-macros 2.6.1 -> 2.7.0 (tokio requires ~2.7.0)
- mio 1.0.4 -> 1.2.0 (tokio requires ^1.2.0)
- socket2 0.6.0 -> 0.6.3 (tokio requires ^0.6.3)
- libc 0.2.174 -> 0.2.183 (mio 1.2 requires ^0.2.183)

examples/rust_processors/async_enrichment_processor, examples/
rust_processors/trivial_processor, rotel_python_processor_sdk,
rotel_rust_processor_sdk and utilities Cargo.lock:
- tokio 1.53.1 -> 1.53.3

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@mheffner
mheffner merged commit 6713327 into rotel-dev:main Oct 26, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant