Repository navigation
fix(deps): patch 14 dependabot security advisories - #61
Merged
Merged
Conversation
Rust (Cargo.lock): - openssl 0.10.74 -> 0.10.78 (4 high + 1 low: GHSA-99-103) - rustls-webpki -> 0.103.13 (high: GHSA-105) - actix-http 3.11.2 -> 3.12.1 (medium CL.TE smuggling: GHSA-97) npm: - svelte: bump dev dep to ^5.53.5 in svelte-analytics SDK, resolves to 5.55.5 (4 medium SSR XSS: GHSA-106-109) - protobufjs: pin >=7.5.5 via overrides/resolutions in vercel-ai-tracing example (critical RCE: GHSA-96) - next 16.2.2 -> 16.2.3 in nextjs/basic example (high DoS: GHSA-91) Not fixed (transitively pinned upstream): - protobuf 2.28.0 (via prometheus 0.13 <- pingora 0.8) - remove_dir_all 0.5.3 (via tempdir 0.3 <- nixpacks 1.41) - rustls-webpki 0.101.7 (via rustls 0.21 <- aws-smithy-http-client) These 3 require upstream releases of pingora, nixpacks, and the AWS SDK to bump their own pinned dependencies.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Patches 14 of 17 open Dependabot advisories on this repo. The remaining 3 are transitively pinned by upstream crates that haven't released a fix; they're called out below for tracking.
Fixed (14)
Rust (
Cargo.lock) —cargo updateopenssl0.10.74 → 0.10.78 — 4 high + 1 low (rustsec advisories docs: rolling auto-improve #99–103: PSK callback memory leak, AES key wrap, MdCtxRef overflow, Deriver buffer overflow, PEM password OOB read).rustls-webpki0.103.x → 0.103.13 — high (perf(proxy): bind the load balancer before loading routes #105: DoS via panic on malformed CRL BIT STRING).actix-http3.11.2 → 3.12.1 — medium (feat(proxy): branded 404 for unknown hosts behind admin gate #97: HTTP/1.1 CL.TE request smuggling).npm
svelte—sdks/node/packages/svelte-analytics/package.json: dev dep bumped to^5.53.5, peer relaxed to^4.2.20 || >=5.53.5, lock now resolves 5.55.5 (test #106–109: 4 medium SSR XSS / dynamic element validation).protobufjs—examples/node/vercel-ai-tracing/package.json: addedoverrides+resolutionspin to^7.5.5; bothbun.lockandpackage-lock.jsonnow resolve 7.5.5 (feat(git): Vercel-style sticky PR/MR preview comments on deploys #96: critical arbitrary code execution).next—examples/nextjs/basic/package.json: 16.2.2 → 16.2.3 (Bug: Invalid admin email on first setup sticks in acme.sh; retries in Temps don’t fix it #91: high DoS with Server Components).Not fixed in this PR (3) — upstream-blocked
protobuf2.28.0prometheus 0.13←pingora 0.8pins this. Needs Pingora to upgradeprometheus.remove_dir_all0.5.3tempdir 0.3(unmaintained) ←nixpacks 1.41. Needs nixpacks to switch totempfile.rustls-webpki0.101.7rustls 0.21←aws-smithy-http-client. Needs AWS SDK to upgraderustls.These should be tracked separately and revisited when upstream releases land.
Test plan
cargo check --lib— 214 crates, 0 errors, 1 pre-existing warning (unrelatedtemps-captcha-wasmworkspace profile note)bun installsucceeds insdks/node,examples/node/vercel-ai-tracing,examples/nextjs/basic