jerry/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-10-27 04:30:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(deps): bump webpki crates for RUSTSEC-2026-0381/0382/0383 (#8499)

Browse Source 
## Summary
On 2026-10-19, RustSec published three advisories against the TLS
certificate crates in our lockfiles. Since then, `cargo-deny check`
fails on advisories. That breaks `Security Domain / Security` on `main`
and on every PR that runs the Rust security job.

| Advisory | Crate | Change |
|---|---|---|
| RUSTSEC-2026-0382 | `rustls-webpki` (distrusted intermediates) |
0.103.15 → 0.103.16 |
| RUSTSEC-2026-0381 | `webpki-roots` (distrusted emSign roots) |
1.0.7/1.0.8 → 1.0.10 |
| RUSTSEC-2026-0383 | `webpki-root-certs` (same roots) | 1.0.7/1.0.8 →
1.0.10 |

This PR bumps all three in `Cargo.lock` and
`desktop/src-tauri/Cargo.lock`. Only these packages change.

`webpki-roots 0.26.11` stays because `tokio-tungstenite` 0.28/0.29 (via
axum and nostr-sdk) still require `^0.26`, and no patched 0.26 release
exists. 0.26.11 is a semver-trick shim that bundles no certificates of
its own. It re-exports `webpki-roots` 1, which now resolves to the
patched 1.0.10. `deny.toml` ignores RUSTSEC-2026-0381 for that shim and
explains why. The ignore should come out once those consumers move to
`webpki-roots` 1.

### Related issue
N/A. I searched for open PRs bumping these crates and found none.

### Testing
- `cargo-deny check`: `advisories ok, bans ok, licenses ok, sources ok`.
On `origin/main` it reports `advisories FAILED`.
- `cargo check --locked -p buzz-ws-client -p buzz-cli -p buzz-relay`
passes.
- The pre-push hook's Rust unit tests pass.

Signed-off-by: Fizz <6be7be23ec5bba868f3e1db5ec86013d76bd1a293dce5b435a192158fec13641@buzz.block.builderlab.xyz>
Co-authored-by: Fizz <6be7be23ec5bba868f3e1db5ec86013d76bd1a293dce5b435a192158fec13641@buzz.block.builderlab.xyz>
This commit is contained in:
Diem Nguyen
2026-10-20 14:52:14 -07:00
committed by GitHub
parent ca35114209
commit 8bbfe44f77
3 changed files with 31 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
deny.toml
View File

@@ -43,6 +43,11 @@ ignore = [
{ id = "RUSTSEC-2026-0370", reason = "zvariant via buzz-mesh-smoke → mesh-llm → keyring 4 → secret-service 5 → zbus 5; unmaintained, not vulnerable" },
{ id = "RUSTSEC-2026-0371", reason = "zbus_names via buzz-mesh-smoke → mesh-llm → keyring 4 → secret-service 5 → zbus 5; unmaintained, not vulnerable" },
{ id = "RUSTSEC-2026-0372", reason = "zvariant_derive via buzz-mesh-smoke → mesh-llm → keyring 4 → secret-service 5 → zbus 5; unmaintained, not vulnerable" },
# webpki-roots 0.26.11 bundles no certificates: it re-exports webpki-roots 1,
# which the lockfile pins at the patched 1.0.10. tokio-tungstenite 0.28/0.29
# (via axum and nostr-sdk) still require ^0.26, and no patched 0.26 release
# exists. Remove when those consumers move to webpki-roots 1.
{ id = "RUSTSEC-2026-0381", reason = "only webpki-roots 0.26.11 remains: a shim re-exporting the patched 1.0.10; required by tokio-tungstenite 0.28/0.29" },
]
[licenses]