From ca275b6d0ecc0b72cb13978ff227200727f6334c Mon Sep 17 00:00:00 2001 From: Weston Pace Date: Fri, 16 Oct 2026 17:05:29 -0500 Subject: [PATCH] ci: ignore yanked zip, update rustls, remove unneeded deny rules (#4560) Old versions of the zip crate have been yanked due to some rather serious vulnerabilities. However, it is a transitive dependency via `candle` and they have not yet released a patch. For now I think the best course of action is to continue to ship, knowing that we will need to address this issue as soon as candle upgrades. I also updated rustls since we have passed the 48 hour mark and I removed all deny exclusions that were no longer needed. --- Cargo.lock | 12 ++++++------ deny.toml | 37 ------------------------------------- 2 files changed, 6 insertions(+), 43 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index ad9eb6d41..66e777cb1 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3083,7 +3083,7 @@ dependencies = [ "libc", "option-ext", "redox_users", - "windows-sys 0.59.0", + "windows-sys 0.60.2", ] [[package]] @@ -6573,7 +6573,7 @@ version = "0.50.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5" dependencies = [ - "windows-sys 0.59.0", + "windows-sys 0.60.2", ] [[package]] @@ -9173,9 +9173,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "log", @@ -11919,9 +11919,9 @@ dependencies = [ [[package]] name = "zip" -version = "7.2.0" +version = "7.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c42e33efc22a0650c311c2ef19115ce232583abbe80850bc8b66509ebef02de0" +checksum = "cc12baa6db2b15a140161ce53d72209dacea594230798c24774139b54ecaa980" dependencies = [ "crc32fast", "indexmap 2.14.0", diff --git a/deny.toml b/deny.toml index d5f42dbff..1a6977d1c 100644 --- a/deny.toml +++ b/deny.toml @@ -68,43 +68,12 @@ ignore = [ # https://rustsec.org/advisories/RUSTSEC-2025-0119 { id = "RUSTSEC-2025-0119", reason = "transitive via hf-hub/indicatif; cosmetic formatting crate" }, - # rustls-webpki 0.101.7 (old major line): name-constraint checks for - # URI / wildcard names. Pulled in only via the legacy rustls 0.21 chain - # from aws-smithy-http-client. The 0.103 line we actively use is patched. - # Clearing the 0.101 copy requires the aws-sdk chain to migrate off - # rustls 0.21. - # https://rustsec.org/advisories/RUSTSEC-2026-0098 - # https://rustsec.org/advisories/RUSTSEC-2026-0099 - { id = "RUSTSEC-2026-0098", reason = "only affects rustls-webpki 0.101 from legacy aws-smithy/rustls 0.21 chain" }, - { id = "RUSTSEC-2026-0099", reason = "only affects rustls-webpki 0.101 from legacy aws-smithy/rustls 0.21 chain" }, - - # rustls 0.23.45: four advisories fixed in 0.23.46 (Debug impls leaking - # TLS secrets, ECH rejection buffering, Brotli certificate decompression - # allocation, ServerHello key-exchange downgrade). 0.23.46 was published - # 2026-10-14 and the dependency age policy requires releases to be 48 - # hours old, so the upgrade cannot land yet. Remove these entries and run - # `cargo update -p rustls` once the window has passed. Mirrors lance #9985. - # https://rustsec.org/advisories/RUSTSEC-2026-0346 - # https://rustsec.org/advisories/RUSTSEC-2026-0347 - # https://rustsec.org/advisories/RUSTSEC-2026-0348 - # https://rustsec.org/advisories/RUSTSEC-2026-0349 - { id = "RUSTSEC-2026-0346", reason = "fixed in rustls 0.23.46; blocked on the 48-hour release age policy" }, - { id = "RUSTSEC-2026-0347", reason = "fixed in rustls 0.23.46; blocked on the 48-hour release age policy" }, - { id = "RUSTSEC-2026-0348", reason = "fixed in rustls 0.23.46; blocked on the 48-hour release age policy" }, - { id = "RUSTSEC-2026-0349", reason = "fixed in rustls 0.23.46; blocked on the 48-hour release age policy" }, - # unsafe-libyaml: unmaintained. Transitive via lance-tokenizer → lindera # → serde_yaml_ng. No maintained upgrade exists; clearing it requires # lindera to move off serde_yaml_ng. # https://rustsec.org/advisories/RUSTSEC-2024-0449 { id = "RUSTSEC-2024-0449", reason = "transitive via lindera (lance-tokenizer); no maintained upgrade available" }, - # rustls-webpki 0.101.7: reachable panic in CRL parsing. Same legacy - # rustls 0.21 chain from aws-smithy-http-client as above. The 0.103 line - # we actively use is upgraded to 0.103.13 which contains the fix. - # https://rustsec.org/advisories/RUSTSEC-2026-0104 - { id = "RUSTSEC-2026-0104", reason = "only affects rustls-webpki 0.101 from legacy aws-smithy/rustls 0.21 chain" }, - # pyo3 advisories in the Python bindings; tracked pending a patched pyo3 release. # https://rustsec.org/advisories/RUSTSEC-2026-0176 # https://rustsec.org/advisories/RUSTSEC-2026-0177 @@ -129,12 +98,6 @@ ignore = [ # compact_str/smol_str, so clearing this requires polars to migrate. # https://rustsec.org/advisories/RUSTSEC-2026-0249 { id = "RUSTSEC-2026-0249", reason = "smartstring unmaintained via polars; no fixed upstream release" }, - - # h2 0.3: empty DATA frames can be queued without limit. The patched - # h2 0.4 line is locked to 0.4.16, but no patched 0.3 release exists. - # The old copy is pulled in by aws-smithy's legacy hyper 0.14 client. - # https://rustsec.org/advisories/RUSTSEC-2026-0258 - { id = "RUSTSEC-2026-0258", reason = "h2 0.3 via legacy aws-smithy/hyper 0.14; no patched 0.3 release" }, ] # ---------------------------------------------------------------------------