fix(deps): clear the security audit advisories - #555
Conversation
cargo-deny and pip-audit both fail on main, which blocks every open PR. Four advisories, handled three ways. Bumped, with a fix at least 14 days old: webbrowser 0.8.15 -> 1.2.4 RUSTSEC-2026-0257 19 days lru 0.16.3 -> 0.18.2 RUSTSEC-2026-0253 20 days ruint 1.17.2 -> 1.20.0 RUSTSEC-2026-0220 24 days pip 26.1.2 -> 26.2.1 PYSEC-2026-3721 19 days webbrowser also gains the hardened feature. It rejects non-HTTP(S) URLs before they reach the OS handler, which closes the argument injection class the advisory describes. Both call sites open an https URL: the Auth0 authorize page, and the Stripe checkout URL that arrives in an API response. h2 is bumped to 0.4.17, which is 4 days old and breaks the 14 day rule. This is deliberate. The fix landed in 0.4.16, seven days ago, so no version satisfies both the advisory and the rule. 0.4.16 is also the wrong choice: 0.4.17 corrects it to ignore end-of-stream frames, without which the new limiter rejects valid traffic. Ownership and the fix commit were checked against hyperium/h2. h2 0.3.27 keeps RUSTSEC-2026-0258 and is now ignored in deny.toml. The fix is on the 0.4 line and 0.3 has had no backport since July 2025, so no bump resolves it. It reaches us through hyper 0.14, under the same axum 0.6 / tonic 0.10 / kube 0.88 / reqwest 0.11 stack as the rustls-webpki entries above it, and goes when that stack does. Restored aws-sdk-s3 to 1.120.0, which the lru bump had quietly moved down to 1.119.0. cargo deny reports advisories ok, bans ok, licenses ok, sources ok. pip-audit reports no known vulnerabilities. Workspace builds, 670 tests pass across validator, cli and sdk.
|
Warning Review limit reachedNext included review available in 30 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
WalkthroughThis PR clears four security audit advisories that are failing CI on every open PR. Three Rust crates and one Python package are bumped to patched versions ( Changes
Estimated review effort: 2/5 (mechanical dependency bumps with well-documented rationale; the only non-obvious decision is the h2 version choice, which is thoroughly explained in the PR description). Instant overview - a deep technical review follows as a separate comment. |
PR #555: fix(deps): clear the security audit advisoriesSummaryClears four security advisories that were failing ArchitectureNo structural impact. The lock now carries two majors of Issues FoundCRITICAL Issues (Must Fix Before Merge)None found. HIGH Severity Issues (Advised to Fix Before Merge)None found. MEDIUM Severity Issues (Optional to Fix Before Merge)None found. LOW Severity Issues (Minor Improvements)
Security ReviewSurface swept: this diff is dependency-only, so the relevant surface is supply chain and the one behavior change.
Suggestions for Improvements
Positive Observations
Recommendation and Next StepsAPPROVE — a thoroughly verified, well-documented advisory-clearing change whose only residual concerns are four low-severity documentation/operability nits that can be addressed in follow-ups or a description edit. |
1 participant
security-auditandtest-python-sdkare failing on every open PR, not just one — 519, 553 and 554 all show the same two red jobs on dependencies none of them touch. Four advisories, handled three ways.Bumped, with a fix at least 14 days old
webbrowserlruruintpipwebbrowseralso gains thehardenedfeature, which the advisory recommends: it rejects non-HTTP(S) URLs before they reach the OS handler, closing the argument-injection class described there. Both call sites open an https URL — the Auth0 authorize page (auth/oauth_flow.rs) and the Stripecheckout_url(handlers/fund/card.rs). The second is the one that matters, since that URL arrives in an API response rather than being built locally.The 14-day floor is a deliberate soak period: it avoids adopting a release fresh enough that a compromised or broken publish has not yet been noticed. Every transitive crate pulled in by these bumps was checked against it too — the oldest is
objc2-foundationat 323 days, the youngestsimd_cesu8at 41.The exception:
h2at 4 daysh2 0.4.13→0.4.17, which is 4 days old and breaks the rule above.No version satisfies both constraints. The fix landed in
0.4.16seven days ago, and every release since is newer still. Waiting until 2026-08-31 would leave CI red for a week.0.4.16is also the wrong target even though it is the nominal fix. From the changelog:0.4.17is a fix to the fix:0.4.16's new limiter counted end-of-stream frames it should not have, so it rejects legitimate traffic. Shipping0.4.16would trade a DoS vector for a correctness bug in our own HTTP/2 stack.0.4.18and0.4.19are budget-heuristic refinements — a new tunable, then a retuned default — and still visibly settling, so0.4.17is the conservative pick: the oldest version that is both patched and correct.Since the rule was bent, provenance was checked rather than assumed:
hyperium/h2, 764M downloads193833e8, "limit excessive amount of small DATA frames") is seanmonstar's own, and he cut the releaseOne thing to watch after this lands: the limiter caps small DATA frames, and validator telemetry streams over tonic. If a budget is ever too tight, long-lived streaming is where it would show.
Ignored:
h2 0.3.27RUSTSEC-2026-0258 also matches
h2 0.3.27, and no bump can fix that one. The advisory's fix is on the 0.4 line; 0.3 has had no release since 0.3.27 in July 2025.It reaches us only through
hyper 0.14.32, which is pulled byaxum 0.6,tonic 0.10,kube-client 0.88andreqwest 0.11— the same stack therustls-webpkientries directly above it indeny.tomlare already ignored for, and scheduled for removal in the 0.27.0 subnet cleanup. Resolving it properly means a hyper 0.14 → 1.x migration across four frameworks.The ignore is by advisory id because
crate = "..."entries apply only to yanked crates, not vulnerabilities. That is safe here: the advisory is defined as fixed in>=0.4.16, so it can never mask the0.4.17pinned in this same change — only the unfixable 0.3.x path.One incidental fix
The
lrubump quietly movedaws-sdk-s3from 1.120.0 down to 1.119.0. That was caught and restored. Worth knowingcargo update --precisecan shift unrelated crates.Verification
cargo check --workspace --all-targetscleancargo fmt --all --checkcleanlru0.16 → 0.18 is a major bump andwebbrowser0.8 → 1.2 is too; both compile and test clean, andwebbrowser::open's signature is unchangedOnly four crates changed version in
Cargo.lock—h2,lru,ruint,webbrowser. The rest of that diff is new transitive entries.Merge order
This touches
Cargo.lockbroadly, so it will conflict with anything else that moves the lock. Worth landing before 554 and 519.