jerry/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-10-27 04:30:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(deps): bump webpki crates for RUSTSEC-2026-0381/0382/0383 (#8499)

Browse Source 
## Summary
On 2026-10-19, RustSec published three advisories against the TLS
certificate crates in our lockfiles. Since then, `cargo-deny check`
fails on advisories. That breaks `Security Domain / Security` on `main`
and on every PR that runs the Rust security job.

| Advisory | Crate | Change |
|---|---|---|
| RUSTSEC-2026-0382 | `rustls-webpki` (distrusted intermediates) |
0.103.15 → 0.103.16 |
| RUSTSEC-2026-0381 | `webpki-roots` (distrusted emSign roots) |
1.0.7/1.0.8 → 1.0.10 |
| RUSTSEC-2026-0383 | `webpki-root-certs` (same roots) | 1.0.7/1.0.8 →
1.0.10 |

This PR bumps all three in `Cargo.lock` and
`desktop/src-tauri/Cargo.lock`. Only these packages change.

`webpki-roots 0.26.11` stays because `tokio-tungstenite` 0.28/0.29 (via
axum and nostr-sdk) still require `^0.26`, and no patched 0.26 release
exists. 0.26.11 is a semver-trick shim that bundles no certificates of
its own. It re-exports `webpki-roots` 1, which now resolves to the
patched 1.0.10. `deny.toml` ignores RUSTSEC-2026-0381 for that shim and
explains why. The ignore should come out once those consumers move to
`webpki-roots` 1.

### Related issue
N/A. I searched for open PRs bumping these crates and found none.

### Testing
- `cargo-deny check`: `advisories ok, bans ok, licenses ok, sources ok`.
On `origin/main` it reports `advisories FAILED`.
- `cargo check --locked -p buzz-ws-client -p buzz-cli -p buzz-relay`
passes.
- The pre-push hook's Rust unit tests pass.

Signed-off-by: Fizz <6be7be23ec5bba868f3e1db5ec86013d76bd1a293dce5b435a192158fec13641@buzz.block.builderlab.xyz>
Co-authored-by: Fizz <6be7be23ec5bba868f3e1db5ec86013d76bd1a293dce5b435a192158fec13641@buzz.block.builderlab.xyz>
This commit is contained in:
Diem Nguyen
2026-10-20 14:52:14 -07:00
committed by GitHub
parent ca35114209
commit 8bbfe44f77
3 changed files with 31 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
Cargo.lock generated
View File

@@ -489,7 +489,7 @@ dependencies = [
"serde",
"serde_json",
"url",
"webpki-roots 1.0.7",
"webpki-roots 1.0.10",
]
[[package]]
@@ -2596,7 +2596,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ccc2776f0c61eca1ca32528f85548abd1a4be8fb53d1b21c013e4f18da1e7090"
dependencies = [
"data-encoding",
"syn 2.0.117",
"syn 1.0.109",
]
[[package]]
@@ -4077,7 +4077,7 @@ dependencies = [
"tokio",
"tokio-rustls",
"tower-service",
"webpki-roots 1.0.7",
"webpki-roots 1.0.10",
]
[[package]]
@@ -4614,7 +4614,7 @@ dependencies = [
"tokio-websockets",
"tracing",
"url",
"webpki-roots 1.0.7",
"webpki-roots 1.0.10",
"ws_stream_wasm",
]
@@ -8546,7 +8546,7 @@ dependencies = [
"wasm-bindgen-futures",
"wasm-streams 0.4.2",
"web-sys",
"webpki-roots 1.0.7",
"webpki-roots 1.0.10",
]
[[package]]
@@ -8898,9 +8898,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
[[package]]
name = "rustls-webpki"
version = "0.103.15"
version = "0.103.16"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
dependencies = [
"aws-lc-rs",
"ring",
@@ -9897,7 +9897,7 @@ dependencies = [
"tracing",
"url",
"uuid",
"webpki-roots 1.0.7",
"webpki-roots 1.0.10",
]
[[package]]
@@ -11629,9 +11629,9 @@ dependencies = [
[[package]]
name = "webpki-root-certs"
version = "1.0.7"
version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f31141ce3fc3e300ae89b78c0dd67f9708061d1d2eda54b8209346fd6be9a92c"
checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb"
dependencies = [
"rustls-pki-types",
]
@@ -11642,14 +11642,14 @@ version = "0.26.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
dependencies = [
"webpki-roots 1.0.7",
"webpki-roots 1.0.10",
]
[[package]]
name = "webpki-roots"
version = "1.0.7"
version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "52f5ee44c96cf55f1b349600768e3ece3a8f26010c05265ab73f945bb1a2eb9d"
checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
dependencies = [
"rustls-pki-types",
]

5
deny.toml
View File

@@ -43,6 +43,11 @@ ignore = [
{ id = "RUSTSEC-2026-0370", reason = "zvariant via buzz-mesh-smoke → mesh-llm → keyring 4 → secret-service 5 → zbus 5; unmaintained, not vulnerable" },
{ id = "RUSTSEC-2026-0371", reason = "zbus_names via buzz-mesh-smoke → mesh-llm → keyring 4 → secret-service 5 → zbus 5; unmaintained, not vulnerable" },
{ id = "RUSTSEC-2026-0372", reason = "zvariant_derive via buzz-mesh-smoke → mesh-llm → keyring 4 → secret-service 5 → zbus 5; unmaintained, not vulnerable" },
# webpki-roots 0.26.11 bundles no certificates: it re-exports webpki-roots 1,
# which the lockfile pins at the patched 1.0.10. tokio-tungstenite 0.28/0.29
# (via axum and nostr-sdk) still require ^0.26, and no patched 0.26 release
# exists. Remove when those consumers move to webpki-roots 1.
{ id = "RUSTSEC-2026-0381", reason = "only webpki-roots 0.26.11 remains: a shim re-exporting the patched 1.0.10; required by tokio-tungstenite 0.28/0.29" },
]
[licenses]

26
desktop/src-tauri/Cargo.lock generated
View File

@@ -558,7 +558,7 @@ dependencies = [
"serde",
"serde_json",
"url",
"webpki-roots 1.0.8",
"webpki-roots 1.0.10",
]
[[package]]
@@ -2396,7 +2396,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ccc2776f0c61eca1ca32528f85548abd1a4be8fb53d1b21c013e4f18da1e7090"
dependencies = [
"data-encoding",
"syn 2.0.118",
"syn 1.0.109",
]
[[package]]
@@ -4088,7 +4088,7 @@ dependencies = [
"tokio",
"tokio-rustls",
"tower-service",
"webpki-roots 1.0.8",
"webpki-roots 1.0.10",
]
[[package]]
@@ -4613,7 +4613,7 @@ dependencies = [
"tokio-websockets",
"tracing",
"url",
"webpki-roots 1.0.8",
"webpki-roots 1.0.10",
"ws_stream_wasm",
]
@@ -8713,7 +8713,7 @@ dependencies = [
"wasm-bindgen-futures",
"wasm-streams 0.4.2",
"web-sys",
"webpki-roots 1.0.8",
"webpki-roots 1.0.10",
]
[[package]]
@@ -9145,9 +9145,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
[[package]]
name = "rustls-webpki"
version = "0.103.15"
version = "0.103.16"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
dependencies = [
"aws-lc-rs",
"ring",
@@ -11132,7 +11132,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
dependencies = [
"fastrand",
"getrandom 0.4.3",
"getrandom 0.3.4",
"once_cell",
"rustix",
"windows-sys 0.61.2",
@@ -12634,9 +12634,9 @@ dependencies = [
[[package]]
name = "webpki-root-certs"
version = "1.0.8"
version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0d46a5a140e6f7afeccd8eae97eff335163939eac8b929834875168b29b3d267"
checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb"
dependencies = [
"rustls-pki-types",
]
@@ -12647,14 +12647,14 @@ version = "0.26.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
dependencies = [
"webpki-roots 1.0.8",
"webpki-roots 1.0.10",
]
[[package]]
name = "webpki-roots"
version = "1.0.8"
version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf"
checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
dependencies = [
"rustls-pki-types",
]