Update the harness lock file past the twelve open advisories - #4
Merged
Merged
Conversation
All twelve Dependabot alerts of the repository sit in the lock file of the Rust harness, all of them in transitive dependencies, so nothing in Cargo.toml has to move: aws-lc-sys 0.37.0 -> 0.45.0 (5 high, needed >= 0.39.0) rustls-webpki 0.103.9 -> 0.103.15 (1 high, 1 moderate, 2 low, >= 0.103.13) quinn-proto 0.11.13 -> 0.11.18 (2 high, needed >= 0.11.15) rand 0.9.2 -> 0.9.5 (1 low, needed >= 0.9.3) aws-lc-sys pulls aws-lc-rs 1.15.4 -> 1.18.1 with it. This also contains the three open Dependabot pull requests, none of which covered the five high severity aws-lc-sys advisories. Not compiled locally: darling 0.23.0 has been in the lock file all along and wants rustc 1.88, while the cargo inside WSL Debian is 1.85, so the harness cannot be checked here at all. The lock file resolves; CI has the toolchain to say the rest. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
All twelve open Dependabot alerts of this repository sit in
tools/s2-rust-harness/Cargo.lock, all of them in transitive dependencies, soCargo.tomldoes not move:aws-lc-syspullsaws-lc-rs1.15.4 → 1.18.1 with it.This supersedes the three open Dependabot pull requests (#1 rustls-webpki, #2
quinn-proto, #3 rand) — none of which covered the five high severity
aws-lc-sysadvisories.Not compiled locally.
darling 0.23.0has been in the lock file all alongand requires rustc 1.88, while the cargo inside WSL Debian is 1.85, so the
harness cannot be checked on that machine at all.
cargo updateresolvedcleanly; this PR exists so that CI, which has the toolchain, gives the verdict
before the change reaches master.
🤖 Generated with Claude Code