From a0dfd9a7b661a679291a1acfe95fa9a7611417d1 Mon Sep 17 00:00:00 2001 From: Daniel Thom Date: Sat, 4 Jul 2026 07:26:22 -0600 Subject: [PATCH] fix(deps): bump bcrypt to 0.19.2 for RUSTSEC-2026-0199 bcrypt 0.19.1 panics in `bcrypt::verify` / `HashParts::from_str` when given a 60-byte hash string containing a multi-byte UTF-8 character at certain byte positions (RUSTSEC-2026-0199). This is a denial-of-service if an attacker-controlled hash reaches those functions. The fix ships in bcrypt 0.19.2, which rejects non-ASCII hash bytes up front. The manifest already allows it (`bcrypt = "0.19"`), so this is a lockfile-only bump. Co-Authored-By: Claude Opus 4.8 (1M context) --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 1f85e544..884e307b 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -322,9 +322,9 @@ dependencies = [ [[package]] name = "bcrypt" -version = "0.19.1" +version = "0.19.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "24ae5479c93d3720e4c1dbd6b945b97457c50cb672781104768190371df1a905" +checksum = "7f3c067aa24dd4ed5c79cf222a38f260c8f23d3b82a062fba3f28c6fe563b753" dependencies = [ "base64 0.22.1", "blowfish",