fix: update actix-http to 3.12.1 to resolve GHSA-xhj4-vrgc-hr34

[acarl005]

Summary

Updates actix-http from 3.11.0 to 3.12.1 to resolve GHSA-xhj4-vrgc-hr34 — an HTTP/1.1 CL.TE Request Smuggling vulnerability.

Dependabot alert: https://github.com/warpdotdev/warp/security/dependabot/3

What changed

• actix-http: 3.11.0 → 3.12.1
• prettyplease: 0.2.15 → 0.2.37 (transitive, required to resolve dependency conflict)
• New transitive dependencies added: rand 0.10.1, getrandom 0.4.2, wasip3, wit-bindgen ecosystem crates

This is a Cargo.lock-only change — no source code modifications.

Why Dependabot couldn't fix this

Dependabot reported: "The latest possible version of actix-http that can be installed is 3.12.0. The earliest fixed version is 3.12.1."

The root cause: actix-http 3.12.1 bumped its rand dependency from ^0.9 to ^0.10.1. The new rand 0.10.1 transitively requires getrandom 0.4.0 → wasip3 → wit-bindgen 0.51.0 → wit-bindgen-rust-macro 0.51.0 → prettyplease ^0.2.20, which conflicted with the locked prettyplease 0.2.15. Dependabot only updates one package at a time, so it couldn't resolve the prettyplease conflict simultaneously.

Fix: cargo update -p actix-http --precise 3.12.1 -p prettyplease — updating both packages together resolves the conflict.

Dependency relationship

actix-http is a transitive dependency pulled in via:

• sentry 0.41.0 → sentry-actix 0.41.0 → actix-http
• sentry-actix 0.41.0 → actix-web 4.10.2 → actix-http

Verification

• cargo audit confirms GHSA-xhj4-vrgc-hr34 no longer appears for actix-http

---

Conversation: https://staging.warp.dev/conversation/76c240a3-d74e-4e2f-adf6-39f3dc80d0c8
Run: https://oz.staging.warp.dev/runs/019dee91-7d86-7a3d-a126-d0f792b56772
This PR was generated with Oz.

[oz-for-oss]

@acarl005

I'm starting a first review of this pull request.

You can view the conversation on Warp.

I completed the review and no human review was requested for this pull request.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

[oz-for-oss]

Overview

This Cargo.lock-only PR updates actix-http from 3.11.0 to 3.12.1 to pick up the fix for GHSA-xhj4-vrgc-hr34, along with resolver-required transitive changes including prettyplease and rand/getrandom/WASI-related packages.

Concerns

• No blocking correctness or security concerns found in the annotated diff. New and updated dependencies are registry packages with checksums pinned in Cargo.lock; no source, configuration, authentication, secret-handling, or runtime input-handling logic changed.

Verdict

Found: 0 critical, 0 important, 0 suggestions

Approve

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz