Fix Rust audit violations #329
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -53,6 +53,12 @@ GITHUB_TOOL_WASM_TARGET := wasm32-wasip2 | |
| # https://github.com/leynos/axinite/issues/212. | ||
| # RUSTSEC-2025-0134: rustls-pemfile 2.2.0 is unmaintained via the libsql TLS | ||
| # chain. Track removal in https://github.com/leynos/axinite/issues/213. | ||
| # RUSTSEC-2026-0235: rkyv 0.7.46 is an optional rust_decimal dependency. No | ||
| # Axinite feature enables rust_decimal's rkyv feature; remove when rust_decimal | ||
| # no longer records rkyv <0.8.17 in its published dependency metadata. | ||
| # RUSTSEC-2026-0258: h2 0.3.27 is required by libsql 0.9's remote-replica | ||
| # client stack. Remote replicas are supported, so remove when libsql no longer | ||
| # requires h2 <0.4.16. | ||
| # kuchikikiki 0.9.2 is yanked via readabilityrs. cargo-audit exposes no | ||
| # advisory ID to ignore for this warning; track removal in | ||
| # https://github.com/leynos/axinite/issues/214. | ||
|
|
@@ -64,7 +70,9 @@ AUDIT_FLAGS ?= \ | |
| --ignore RUSTSEC-2026-0185 \ | ||
| --ignore RUSTSEC-2025-0141 \ | ||
| --ignore RUSTSEC-2024-0370 \ | ||
| --ignore RUSTSEC-2025-0134 \ | ||
| --ignore RUSTSEC-2026-0235 \ | ||
| --ignore RUSTSEC-2026-0258 | ||
|
Comment on lines
+73
to
+75
Contributor
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- Makefile relevant lines ---'
sed -n '45,170p' Makefile
printf '%s\n' '--- audit-related references ---'
rg -n -C 3 'AUDIT_FLAGS|rust-audit|RUSTSEC-2025-0134|RUSTSEC-2026-0235|RUSTSEC-2026-0258|rust_decimal|libSQL|rkyv|h2' Makefile Cargo.toml Cargo.lock .github 2>/dev/null || true
printf '%s\n' '--- Cargo manifests ---'
find . -name Cargo.toml -not -path './target/*' -print
printf '%s\n' '--- workspace and package declarations ---'
rg -n '^\[workspace|^members|^exclude|^name\s*=|^version\s*=' --glob 'Cargo.toml' .Repository: leynos/axinite Length of output: 20611 🏁 Script executed: #!/bin/bash
set -eu
sed -n '45,170p' Makefile
printf '\n--- references ---\n'
rg -n -C 3 'AUDIT_FLAGS|rust-audit|RUSTSEC-2025-0134|RUSTSEC-2026-0235|RUSTSEC-2026-0258|rust_decimal|libSQL|rkyv|h2' Makefile Cargo.toml Cargo.lock .github 2>/dev/null || true
printf '\n--- manifests ---\n'
find . -name Cargo.toml -not -path './target/*' -printRepository: leynos/axinite Length of output: 16277 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- Makefile 45-170 ---'
sed -n '45,170p' Makefile
printf '%s\n' '--- audit references ---'
rg -n -C 3 'AUDIT_FLAGS|rust-audit|RUSTSEC-2025-0134|RUSTSEC-2026-0235|RUSTSEC-2026-0258|rust_decimal|libSQL|rkyv|h2' Makefile Cargo.toml Cargo.lock .github 2>/dev/null || true
printf '%s\n' '--- Cargo manifests ---'
find . -name Cargo.toml -not -path './target/*' -printRepository: leynos/axinite Length of output: 16311 🏁 Script executed: nl -ba Makefile | sed -n '1,180p'Repository: leynos/axinite Length of output: 188 🌐 Web query:
💡 Result: The following are the details for the requested RustSec advisories: RUSTSEC-2025-0134: Unmaintained crate [1]. - Affected Package: rustls-pemfile [1]. - Status: This crate is no longer maintained and the repository has been archived [1][2]. Users are advised to migrate to the PEM parsing code now included in rustls-pki-types (v1.9.0+) [1][3]. There are no patched versions because the crate is discontinued [1][4]. RUSTSEC-2026-0235: Insufficient archive validation leading to out-of-bounds reads [5][6]. - Affected Package: rkyv [5]. - Status: Vulnerable versions include >=0.7.0-pre.2 [5][7]. Version 0.8.17 includes a fix that incorporates pointer metadata into shared pointer (Rc/Arc) validation, preventing the exploitation of conflicting metadata [5][8]. The 0.7 series is no longer supported by upstream [5][6]. RUSTSEC-2026-0258: Unbounded empty DATA frames [9][10]. - Affected Package: h2 (used by hyper) [9][11]. - Status: Vulnerable to denial-of-service due to an internal flaw that accepted and queued unlimited empty DATA frames [9][12]. This could cause unbounded memory usage or panics on overflow [9][11]. Patched in version 0.4.16 [9][11]. Severity is low [9][10]. Citations:
Scope the RustSec exceptions to the documented dependency paths.
🤖 Prompt for AI Agents |
||
|
|
||
| .PHONY: all install install-with-overrides sync-local-wasm-overrides build-github-tool-wasm fmt check-fmt typecheck lint lint-clippy lint-whitaker markdownlint spelling spelling-phrase-check spelling-config spelling-config-write spelling-helper-test nixie audit rust-audit test test-cargo test-matrix test-matrix-cargo test-workflow-contracts clean | ||
|
|
||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
When users run the documented
docker build -f Dockerfile.test ...command, that image still builds with Rust 1.93 (Dockerfile.test:12) and copies this manifest before invoking Cargo, so Cargo will reject the root package now that its minimum version is 1.94. A repo-wide search of operational Rust pins found this remaining builder; update it alongside the two Dockerfiles changed here.Useful? React with 👍 / 👎.