From 19127c52a985d4e25b04357037c3e0704bd6f63a Mon Sep 17 00:00:00 2001 From: Lee Hannigan Date: Tue, 20 Oct 2026 13:21:38 +0000 Subject: [PATCH] fix(deps): update rustls, hickory, quinn-proto, h2 and WeasyPrint for open advisories Moves each dependency with an open Dependabot alert or RustSec advisory to the lowest release that clears every published advisory against it. Collateral crates move to the newest compatible release cargo selects. Cargo.lock: - rustls 0.23.40 to 0.23.46 (GHSA-2mjx-qc3c-rqvc, fixed in 0.23.45; RUSTSEC-2026-0346 to 0349, fixed in 0.23.46). rustls 0.23.46 requires rustls-webpki 0.103.14 or later and aws-lc-rs 1.18 or later; cargo selects rustls-webpki 0.103.16 and aws-lc-rs 1.18.2, which moves aws-lc-sys from 0.41.0 to 0.46.0. - hickory-resolver 0.26.1 to 0.26.3 (GHSA-5j98-2g5x-46v6, GHSA-6w6g-hm98-mhgm, GHSA-6f2x-v7q7-m7m5; fixed in 0.26.2). hickory-proto and hickory-net move to 0.26.3 with it: hickory-resolver 0.26.2 does not compile against hickory-proto 0.26.3, and 0.26.3 fixes resolv.conf parsing regressions in 0.26.2. Only the mongodb driver uses them. - h2 0.4.14 to 0.4.16 (RUSTSEC-2026-0258). tests/rust/Cargo.lock: - rustls 0.23.40 to 0.23.46, with the same rustls-webpki, aws-lc-rs and aws-lc-sys changes. pkg-config 0.3.34 is added because aws-lc-sys has used it as a build dependency since 0.42.0. - quinn-proto 0.11.14 to 0.11.18 (GHSA-4w2j-m93h-cj5j, fixed in 0.11.15; RUSTSEC-2026-0338 to 0343, fixed in 0.11.17 and 0.11.18). quinn-proto 0.11.18 moves rand to 0.10.3 and rand_core to 0.10.1, adds rand_pcg and chacha20, and removes rand_chacha, ppv-lite86, zerocopy and zerocopy-derive. quinn-proto is reqwest's optional HTTP/3 dependency and is not compiled. - h2 0.4.14 to 0.4.16 (RUSTSEC-2026-0258). In both lockfiles cargo also moves the windows-sys dependency of errno, rustix, tempfile, winapi-util and socket2 from 0.61.2 to windows-sys releases the lockfile already contains. cargo 1.88 and 1.99 both do this on any update of main's lockfile. The Windows launcher build compiles the same windows-sys and socket2 versions as before. requirements.txt: - WeasyPrint 68.1 to 70.0 (GHSA-r543-q48m-4c9j, GHSA-jf6q-chmf-3h3v, GHSA-jhhc-3hcp-qhm5). WeasyPrint builds the PDF manuals in docs/build-docs.py and is not used by any test. Since aws-lc-sys 0.42.0, the build script links a system AWS-LC instead of the bundled source when it finds one through pkg-config or OPENSSL_DIR (0.46.0 accepts AWS-LC 5.7.0 or later). The three Dockerfiles and npm-build-matrix.yml now set AWS_LC_SYS_USE_SYSTEM=0, so the published images and launcher binaries build the AWS-LC version named in Cargo.lock. Every updated crate declares rust-version 1.88 or lower. The four license notices files are regenerated. The postgres, mongodb and cassandra notices now list pkg-config 0.3.33 (MIT OR Apache-2.0), and the set of licenses is unchanged. --- .github/workflows/npm-build-matrix.yml | 6 +- Cargo.lock | 41 ++++----- Dockerfile | 1 + Dockerfile.dev | 1 + Dockerfile.mongodb | 1 + SOFTWARE-LICENSE-NOTICES-CASSANDRA.html | 19 +++-- SOFTWARE-LICENSE-NOTICES-DEV.html | 16 ++-- SOFTWARE-LICENSE-NOTICES-MONGODB.html | 25 +++--- SOFTWARE-LICENSE-NOTICES.html | 19 +++-- requirements.txt | 2 +- tests/rust/Cargo.lock | 108 +++++++++++------------- 11 files changed, 119 insertions(+), 120 deletions(-) diff --git a/.github/workflows/npm-build-matrix.yml b/.github/workflows/npm-build-matrix.yml index 596b12b40..db58cd508 100644 --- a/.github/workflows/npm-build-matrix.yml +++ b/.github/workflows/npm-build-matrix.yml @@ -123,7 +123,11 @@ jobs: # SQLite backend only, dev-mode on: the launcher's contract binary. # `--locked` so the build is exactly the reviewed Cargo.lock. The # explicit --target keeps the output path uniform across native and - # cross-compiled platforms. + # cross-compiled platforms. AWS_LC_SYS_USE_SYSTEM=0 makes aws-lc-sys + # build its bundled AWS-LC instead of linking one it finds on the + # runner, so the binary's crypto is the version Cargo.lock names. + env: + AWS_LC_SYS_USE_SYSTEM: '0' run: cargo build --release --locked --no-default-features --features sqlite,dev-mode -p extenddb --target ${{ matrix.target }} - name: The binary must be the target architecture diff --git a/Cargo.lock b/Cargo.lock index a2797101c..b35d2c098 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -256,9 +256,9 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53" [[package]] name = "aws-lc-rs" -version = "1.17.0" +version = "1.18.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00" +checksum = "faac5829c2b74c28f830747e7818ccfb684261b5f48a1118b1e2a13d36dfab13" dependencies = [ "aws-lc-sys", "untrusted 0.7.1", @@ -267,14 +267,15 @@ dependencies = [ [[package]] name = "aws-lc-sys" -version = "0.41.0" +version = "0.46.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4" +checksum = "f1622d8446a2d4b2ce0c7eefc73dd43a99779028d5ee5c2dd8073a658ba8a2bc" dependencies = [ "cc", "cmake", "dunce", "fs_extra", + "pkg-config", ] [[package]] @@ -1193,7 +1194,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -1769,9 +1770,9 @@ dependencies = [ [[package]] name = "h2" -version = "0.4.14" +version = "0.4.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "171fefbc92fe4a4de27e0698d6a5b392d6a0e333506bc49133760b3bcf948733" +checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27" dependencies = [ "atomic-waker", "bytes", @@ -1845,9 +1846,9 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70" [[package]] name = "hickory-net" -version = "0.26.1" +version = "0.26.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e2295ed2f9c31e471e1428a8f88a3f0e1f4b27c15049592138d1eebe9c35b183" +checksum = "c480823ed7c2c5d0f09c41020cb6b7c28029ce60ec42dc942158dcf22f8e0a4d" dependencies = [ "async-trait", "cfg-if", @@ -1869,9 +1870,9 @@ dependencies = [ [[package]] name = "hickory-proto" -version = "0.26.1" +version = "0.26.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0bab31817bfb44672a252e97fe81cd0c18d1b2cf892108922f6818820df8c643" +checksum = "12b92608f679a6fa515dd1d15c1ff89443026e391200a2c840c7afcba482893d" dependencies = [ "data-encoding", "idna", @@ -1889,9 +1890,9 @@ dependencies = [ [[package]] name = "hickory-resolver" -version = "0.26.1" +version = "0.26.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f0d58d28879ceecde6607729660c2667a081ccdc082e082675042793960f178c" +checksum = "3f3da5255c95d5a716857d54b5b8f4e8d67c3484d3beaaaae2ce25063b3ba981" dependencies = [ "cfg-if", "futures-util", @@ -3308,14 +3309,14 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] name = "rustls" -version = "0.23.40" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "log", @@ -3338,9 +3339,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -3993,7 +3994,7 @@ dependencies = [ "getrandom 0.4.2", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -4650,7 +4651,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.48.0", ] [[package]] diff --git a/Dockerfile b/Dockerfile index 04986a4c0..ec27ac9c2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -17,6 +17,7 @@ RUN test -n "${VCS_REF}" \ && test "${BUILD_DATE}" != unknown \ && EXTENDDB_GIT_HASH="${VCS_REF}" \ EXTENDDB_BUILD_TIME="${BUILD_DATE}" \ + AWS_LC_SYS_USE_SYSTEM=0 \ cargo build --locked --release \ -p extenddb --no-default-features --features postgres diff --git a/Dockerfile.dev b/Dockerfile.dev index b36df8494..57f41f117 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -29,6 +29,7 @@ RUN test -n "${VCS_REF}" \ && test "${BUILD_DATE}" != unknown \ && EXTENDDB_GIT_HASH="${VCS_REF}" \ EXTENDDB_BUILD_TIME="${BUILD_DATE}" \ + AWS_LC_SYS_USE_SYSTEM=0 \ cargo build --locked --profile release-slim \ -p extenddb --no-default-features --features sqlite,dev-mode \ && install -d -m 0700 /state diff --git a/Dockerfile.mongodb b/Dockerfile.mongodb index 624444bd9..129864567 100644 --- a/Dockerfile.mongodb +++ b/Dockerfile.mongodb @@ -19,6 +19,7 @@ RUN test -n "${VCS_REF}" \ && test "${BUILD_DATE}" != unknown \ && EXTENDDB_GIT_HASH="${VCS_REF}" \ EXTENDDB_BUILD_TIME="${BUILD_DATE}" \ + AWS_LC_SYS_USE_SYSTEM=0 \ cargo build --locked --release \ -p extenddb --no-default-features --features mongodb diff --git a/SOFTWARE-LICENSE-NOTICES-CASSANDRA.html b/SOFTWARE-LICENSE-NOTICES-CASSANDRA.html index 6c71c3b77..cfe89ef85 100644 --- a/SOFTWARE-LICENSE-NOTICES-CASSANDRA.html +++ b/SOFTWARE-LICENSE-NOTICES-CASSANDRA.html @@ -49,7 +49,7 @@

ExtendDB Software License Notices

Overview of licenses: