Repository navigation
fix(deps): clear seven RustSec advisories in rustls and zip - #426
Merged
Merged
Conversation
rustls 0.23.45 is flagged by RUSTSEC-2026-0346 (Debug impls on client session values print TLS secrets), RUSTSEC-2026-0347 (buffered application data reaches the outer server after an ECH rejection), RUSTSEC-2026-0348 (Brotli certificate decompression can allocate up to 1 GiB before authentication), and RUSTSEC-2026-0349 (an unauthenticated ServerHello can downgrade later connections to classical key exchange). All four are fixed in 0.23.46. This is a lockfile-only patch bump. rustls reaches the daemon through reqwest, tokio-rustls, tungstenite, the Hue driver's DTLS stack, and Servo's networking, so every TLS client in the process picks up the fix. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
utoipa-swagger-ui 10.0.1, the newest release, pins its build-time zip dependency to ^8.6. zip 8.6.0 carries RUSTSEC-2026-0367, 0368, and 0369, and only zip 9 fixes them, so no cargo update can clear the advisories. Upstream merged the move to zip 9 (juhaku/utoipa#1645, commit 5aff30b) on 2026-10-17 but has not released it. This commit vendors the published 10.0.1 crate byte for byte, with checksum 3f5ec9d7 matching the lockfile, and swaps it in through [patch.crates-io], the same way vendor/servo-script works. It carries no source edits; the zip patch lands in the next commit so the vendor's history shows every change against the published crate. The crate is excluded from the workspace, listed in NOTICE, kept out of prettier, and added to the CI rust paths filter so a change that touches only the vendored source still runs Rust CI. scripts/check-vendored-patches.sh already picks up the new patch entry and fails CI once a bump moves the crate off 10.0.1. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
zip 8.6.0 is flagged by RUSTSEC-2026-0367 (SUID and SGID bits survive extraction), RUSTSEC-2026-0368 (ZipArchive::extract writes symlinks that escape the destination), and RUSTSEC-2026-0369 (extraction applies permissions through symlinks). zip 9.0.0 is the first fixed release, and the lockfile now takes 9.0.5. The vendored utoipa-swagger-ui carries upstream's own fix from juhaku/utoipa#1645 (merge commit 5aff30b): the build dependency moves to zip 9.0, and build.rs adds a `?` because ZipFile::name now returns a Result. After the patch, build.rs and every file under src/ match upstream at 5aff30b byte for byte, so the vendor can be dropped as soon as a release ships it. vendor/utoipa-swagger-ui/HYPERCOLOR.md records the patch and the removal rule. zip is only a build dependency here, and the build script copies entries out of a pinned Swagger UI archive itself instead of calling the affected extract APIs, so none of the three was reachable. Fixing it keeps the graph clean and lets cargo deny pass with no advisory ignores. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
|
Warning Review limit reached
This review includes 18 billable files and costs up to $4.50. Or wait 35 minutes for your next included review. View limit details
Comment |
An independent review of the vendor caught wording errors. The removal rule pointed at patches "below" when they sit above it; the upstream status credited the published changelog with an "Unreleased" entry that only exists in upstream's changelog at 5aff30b; the daemon's usage covers the docs UI and the OpenAPI document, not one route; and the NOTICE entry read as if utoipa itself were at 10.0.1. The note also says why the packaged Cargo.lock and Cargo.toml.orig still name zip 8.6: Cargo and cargo deny ignore both when the crate builds as a dependency, so they stay as published. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
3 of 15 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cargo Deny has been red on main since seven new RustSec advisories reached the advisory database: four against rustls 0.23.45 and three against zip 8.6.0. Every open PR inherits the failure. With this change,
cargo deny checkpasses all four sections, anddeny.tomlstill has no advisory ignores.What this changes
Rustls moves from 0.23.45 to 0.23.46. The lockfile diff is that one package, and every TLS client in the daemon picks it up (reqwest, tokio-rustls, tungstenite, the Hue driver's DTLS stack, and Servo's networking).
Zip moves from 8.6.0 to 9.0.5, which takes more work. Zip is only a build dependency of utoipa-swagger-ui, the crate that serves Swagger UI at
/api/v1/docs. Its newest release (10.0.1) requires zip ^8.6, and only zip 9 fixes the advisories, socargo updatecannot reach a fixed version. Upstream merged the move to zip 9 on 2026-10-17 (juhaku/utoipa#1645) but has not released it. This PR vendors utoipa-swagger-ui 10.0.1 undervendor/utoipa-swagger-ui/through[patch.crates-io], following thevendor/servo-scriptpattern, and applies upstream's two-line patch on top.Why
Debugimpls on client session values print TLS secretsZipArchive::extractwrites symlinks that point outside the destinationNone of the zip advisories was reachable here. The build script copies entries out of the Swagger UI archive pinned inside
utoipa-swagger-ui-vendoreditself and never calls the affectedextractAPIs. We fix them anyway so the graph stays clean without ignores.Verification
vendor/utoipa-swagger-ui/HYPERCOLOR.mdandNOTICEjust verifypasses locally (Rust fmt + lint + test): not run in full; the targeted checks below ran insteadjust denypasses (required for dependency or license changes)cargo deny check advisorieson main (01136d87c)cargo deny checkon this branchyoke-derive, duplicate versions) were already therecargo check --workspace --lockedcargo build -p hypercolor-daemon --lockedcargo test -p hypercolor-daemon --test openapi_testsswagger_ui_is_servedcargo test -p hypercolor-daemon --lib swaggerstatic_assets_and_swagger_ui_do_not_need_an_api_keypassesscripts/check-vendored-patches.shvendor/(servo-script, tachys, utoipa-swagger-ui)cargo fmt --all --checkThe build and tests ran before the rebase onto
7aad243e9. That rebase pulled in #416 and #417, which touch no manifest or lockfile, andcargo deny check, the vendor guard, andcargo metadata --lockedreran on the rebased head.Notes for reviewers
Review the vendor commit by commit. The first one (
4e8e2b05c) adds the published crate exactly asutoipa-swagger-ui-10.0.1.crateunpacks, and its checksum (3f5ec9d7) matches the lockfile entry it replaces. The second one (3055ee738) changes two lines: the zip requirement inCargo.tomlbecomes9.0, andbuild.rsadds a?because zip 9'sZipFile::namereturns aResult. After that commit,build.rsand every file undersrc/are byte-identical to upstream at5aff30b, so the vendor holds no code of ours to carry forward when a release ships.The vendor has a built-in exit.
scripts/check-vendored-patches.shalready reads every[patch.crates-io]path entry, so any update that moves utoipa-swagger-ui past 10.0.1 (Dependabot's monthly group or a hand bump) fails CI until the same change deletes the vendor.HYPERCOLOR.mdspells out that rule.I ruled out two alternatives. A
deny.tomlignore would suppress the advisories instead of fixing them. A git patch pointing at upstream master would dragutoipaitself onto unreleased code, because the swagger crate's manifest names it through a path dependency. Master carries about a dozen commits since the release, roughly half of them schema-generation changes that would shift the generated OpenAPI document.Supporting wiring: the vendor directory is excluded from the workspace, listed in
NOTICE, kept out of prettier, and added to the CIrustpaths filter, so a change that touches only the vendored source still runs Rust CI.🤖 Generated with Claude Code