Skip to content

rust: Add RUSTSEC-2026-0104 to audit.toml#6513

Merged
martintomazic merged 2 commits intomasterfrom
martin/internal/rustsec-2026-0104
Apr 22, 2026
Merged

rust: Add RUSTSEC-2026-0104 to audit.toml#6513
martintomazic merged 2 commits intomasterfrom
martin/internal/rustsec-2026-0104

Conversation

@martintomazic
Copy link
Copy Markdown
Contributor

    Scanning Cargo.lock for vulnerabilities (436 crate dependencies)
Crate:     rustls-webpki
Version:   0.102.8
Title:     Reachable panic in certificate revocation list parsing
Date:      2026-04-22
ID:        RUSTSEC-2026-0104
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0104
Solution:  Upgrade to >=0.103.13, <0.104.0-alpha.1 OR >=0.104.0-alpha.7
Dependency tree:
rustls-webpki 0.102.8
└── rustls-mbedcrypto-provider 0.1.1
    └── simple-rofl 0.0.0
Crate:     rustls-webpki
Version:   0.103.12
Title:     Reachable panic in certificate revocation list parsing
Date:      2026-04-22
ID:        RUSTSEC-2026-0104
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0104
Solution:  Upgrade to >=0.103.13, <0.104.0-alpha.1 OR >=0.104.0-alpha.7
Dependency tree:
rustls-webpki 0.103.12
└── rustls 0.23.36
    ├── simple-rofl 0.0.0
    ├── rustls-mbedtls-provider-utils 0.2.1
    │   ├── rustls-mbedpki-provider 0.2.1
    │   │   └── simple-rofl 0.0.0
    │   └── rustls-mbedcrypto-provider 0.1.1
    │       └── simple-rofl 0.0.0
    ├── rustls-mbedpki-provider 0.2.1
    └── rustls-mbedcrypto-provider 0.1.1

@netlify
Copy link
Copy Markdown

netlify Bot commented Apr 22, 2026

Deploy Preview for oasisprotocol-oasis-core canceled.

Name Link
🔨 Latest commit 262b576
🔍 Latest deploy log https://app.netlify.com/projects/oasisprotocol-oasis-core/deploys/69e9253e9c5a9700088d2074

@martintomazic martintomazic marked this pull request as ready for review April 22, 2026 19:22
@martintomazic martintomazic enabled auto-merge April 22, 2026 19:33
Copy link
Copy Markdown
Collaborator

@peternose peternose left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You should upgrade first rustls-webpki to 0.103.13 and then add it to audit.

Run cargo update -p rustls-webpki@0.103.12 to upgrade and add it to audit to ignore older version in tests.

@martintomazic martintomazic disabled auto-merge April 22, 2026 19:36
@martintomazic martintomazic force-pushed the martin/internal/rustsec-2026-0104 branch from b5957c7 to 262b576 Compare April 22, 2026 19:45
Copy link
Copy Markdown
Collaborator

@peternose peternose left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you do the same for SDK, see the last closed PR in SDK repo?

@martintomazic martintomazic enabled auto-merge April 22, 2026 19:46
@martintomazic martintomazic merged commit b9659e7 into master Apr 22, 2026
5 checks passed
@martintomazic martintomazic deleted the martin/internal/rustsec-2026-0104 branch April 22, 2026 20:12
@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 22, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.25%. Comparing base (22656e6) to head (262b576).
⚠️ Report is 5 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #6513      +/-   ##
==========================================
- Coverage   63.87%   63.25%   -0.62%     
==========================================
  Files         698      698              
  Lines       68283    68282       -1     
==========================================
- Hits        43613    43192     -421     
- Misses      19706    20124     +418     
- Partials     4964     4966       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants