Skip to content

Update the harness lock file past the twelve open advisories - #4

Merged
ahzf merged 1 commit into
masterfrom
cargo-advisory-updates
Sep 14, 2026
Merged

ahzf merged 1 commit into
masterfrom
cargo-advisory-updates

Conversation

@ahzf

@ahzf ahzf commented Sep 14, 2026

Copy link
Copy Markdown
Member

All twelve open Dependabot alerts of this repository sit in
tools/s2-rust-harness/Cargo.lock, all of them in transitive dependencies, so
Cargo.toml does not move:

Paket Alerts war jetzt nötig
aws-lc-sys 5 × high 0.37.0 0.45.0 ≥ 0.39.0
rustls-webpki 1 high, 1 moderate, 2 low 0.103.9 0.103.15 ≥ 0.103.13
quinn-proto 2 × high 0.11.13 0.11.18 ≥ 0.11.15
rand 1 low 0.9.2 0.9.5 ≥ 0.9.3

aws-lc-sys pulls aws-lc-rs 1.15.4 → 1.18.1 with it.

This supersedes the three open Dependabot pull requests (#1 rustls-webpki, #2
quinn-proto, #3 rand) — none of which covered the five high severity
aws-lc-sys advisories.

Not compiled locally. darling 0.23.0 has been in the lock file all along
and requires rustc 1.88, while the cargo inside WSL Debian is 1.85, so the
harness cannot be checked on that machine at all. cargo update resolved
cleanly; this PR exists so that CI, which has the toolchain, gives the verdict
before the change reaches master.

🤖 Generated with Claude Code

All twelve Dependabot alerts of the repository sit in the lock file of the
Rust harness, all of them in transitive dependencies, so nothing in
Cargo.toml has to move:

  aws-lc-sys    0.37.0  -> 0.45.0    (5 high,   needed >= 0.39.0)
  rustls-webpki 0.103.9 -> 0.103.15  (1 high, 1 moderate, 2 low, >= 0.103.13)
  quinn-proto   0.11.13 -> 0.11.18   (2 high,   needed >= 0.11.15)
  rand          0.9.2   -> 0.9.5     (1 low,    needed >= 0.9.3)

aws-lc-sys pulls aws-lc-rs 1.15.4 -> 1.18.1 with it. This also contains the
three open Dependabot pull requests, none of which covered the five high
severity aws-lc-sys advisories.

Not compiled locally: darling 0.23.0 has been in the lock file all along and
wants rustc 1.88, while the cargo inside WSL Debian is 1.85, so the harness
cannot be checked here at all. The lock file resolves; CI has the toolchain
to say the rest.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Copilot AI lite review requested due to automatic review settings September 14, 2026 21:21

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.


💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@ahzf
ahzf merged commit d615183 into master Sep 14, 2026
2 checks passed
@ahzf
ahzf deleted the cargo-advisory-updates branch September 14, 2026 21:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants