From 46036a1148edd6f62b39fc443ab32b6cde9aba12 Mon Sep 17 00:00:00 2001 From: Kombiz Lavasany Date: Wed, 14 Oct 2026 16:18:51 -0500 Subject: [PATCH] fix(deps): bump rustls to 0.23.46 and ignore RUSTSEC-2024-0449, as upstream The Security check (cargo-deny advisories) now fails on this branch for reasons unrelated to any change on it: - rustls 0.23.45 has four new advisories, RUSTSEC-2026-0346, -0347, -0348 and -0349. All four are fixed in 0.23.46. Both lockfiles move to it, changing only rustls's version and checksum; a plain `cargo update -p rustls` also moved unrelated windows-sys edges, which are left out. - unsafe-libyaml (via serde_yaml) is flagged unmaintained, RUSTSEC-2024-0449. It is not a vulnerability report. The ignore entry and its reason are copied from upstream. Mirrors upstream block/buzz 67c4fe5e1 (#8319) and the deny.toml part of 03ce924e3 (#8277). Co-Authored-By: Claude Opus 5.5 --- Cargo.lock | 4 ++-- deny.toml | 5 +++++ desktop/src-tauri/Cargo.lock | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 6ce0f5c847d..5984b270aff 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -8386,9 +8386,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "log", diff --git a/deny.toml b/deny.toml index d3c5fcd4bc7..74e83fb3518 100644 --- a/deny.toml +++ b/deny.toml @@ -15,6 +15,11 @@ ignore = [ # remove these when upstream catches up. { id = "RUSTSEC-2026-0194", reason = "transitive via rust-s3 and mesh-llm→plist; trusted-input XML only; no upstream fix available yet" }, { id = "RUSTSEC-2026-0195", reason = "transitive via rust-s3 and mesh-llm→plist; trusted-input XML only; no upstream fix available yet" }, + # unsafe-libyaml 0.2.11 — unmaintained (repository archived 2024-03-25), not a + # vulnerability report. Transitive dep: serde_yaml → unsafe-libyaml. The serde_yaml_ng + # fork uses the same crate, so removing it means migrating YAML parsing in + # buzz-agent, buzz-persona, buzz-relay, buzz-workflow and desktop. + { id = "RUSTSEC-2024-0449", reason = "transitive via serde_yaml; unmaintained, not vulnerable; removal needs a YAML parser migration" }, ] [licenses] diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock index 0bc8293553b..b252f83b40c 100644 --- a/desktop/src-tauri/Cargo.lock +++ b/desktop/src-tauri/Cargo.lock @@ -8928,9 +8928,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "log",