From 33c3c34c959020239a737522b80e79c277746908 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Arpad=20M=C3=BCller?= Date: Mon, 10 Mar 2025 14:24:14 +0100 Subject: [PATCH] Appease cargo deny errors (#11142) * pprof can also use `prost` as a backend, switch to it as `protobuf` has no update available but a security issue. * `paste` is a build time dependency, so add the unmaintained warning as an exception. --- Cargo.lock | 111 ++++++++++++++++++++------------ Cargo.toml | 2 +- deny.toml | 4 ++ libs/http-utils/src/endpoint.rs | 6 +- workspace_hack/Cargo.toml | 6 +- 5 files changed, 82 insertions(+), 47 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index d3b09fa360..f15c6e857f 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -4062,7 +4062,7 @@ dependencies = [ "opentelemetry-http", "opentelemetry-proto", "opentelemetry_sdk", - "prost", + "prost 0.13.3", "reqwest", "thiserror 1.0.69", ] @@ -4075,7 +4075,7 @@ checksum = "a6e05acbfada5ec79023c85368af14abd0b307c015e9064d249b2a950ef459a6" dependencies = [ "opentelemetry", "opentelemetry_sdk", - "prost", + "prost 0.13.3", "tonic", ] @@ -4830,8 +4830,10 @@ dependencies = [ "nix 0.26.4", "once_cell", "parking_lot 0.12.1", - "protobuf", - "protobuf-codegen-pure", + "prost 0.12.6", + "prost-build 0.12.6", + "prost-derive 0.12.6", + "sha2", "smallvec", "symbolic-demangle", "tempfile", @@ -4850,7 +4852,7 @@ dependencies = [ "inferno 0.12.0", "num", "paste", - "prost", + "prost 0.13.3", ] [[package]] @@ -4943,6 +4945,16 @@ dependencies = [ "thiserror 1.0.69", ] +[[package]] +name = "prost" +version = "0.12.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "deb1435c188b76130da55f17a466d252ff7b1418b2ad3e037d127b94e3411f29" +dependencies = [ + "bytes", + "prost-derive 0.12.6", +] + [[package]] name = "prost" version = "0.13.3" @@ -4950,7 +4962,28 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7b0487d90e047de87f984913713b85c601c05609aad5b0df4b4573fbf69aa13f" dependencies = [ "bytes", - "prost-derive", + "prost-derive 0.13.3", +] + +[[package]] +name = "prost-build" +version = "0.12.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "22505a5c94da8e3b7c2996394d1c933236c4d743e81a410bcca4e6989fc066a4" +dependencies = [ + "bytes", + "heck", + "itertools 0.10.5", + "log", + "multimap", + "once_cell", + "petgraph", + "prettyplease", + "prost 0.12.6", + "prost-types 0.12.6", + "regex", + "syn 2.0.90", + "tempfile", ] [[package]] @@ -4967,13 +5000,26 @@ dependencies = [ "once_cell", "petgraph", "prettyplease", - "prost", - "prost-types", + "prost 0.13.3", + "prost-types 0.13.3", "regex", "syn 2.0.90", "tempfile", ] +[[package]] +name = "prost-derive" +version = "0.12.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "81bddcdb20abf9501610992b6759a4c888aef7d1a7247ef75e2404275ac24af1" +dependencies = [ + "anyhow", + "itertools 0.10.5", + "proc-macro2", + "quote", + "syn 2.0.90", +] + [[package]] name = "prost-derive" version = "0.13.3" @@ -4987,38 +5033,22 @@ dependencies = [ "syn 2.0.90", ] +[[package]] +name = "prost-types" +version = "0.12.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9091c90b0a32608e984ff2fa4091273cbdd755d54935c51d520887f4a1dbd5b0" +dependencies = [ + "prost 0.12.6", +] + [[package]] name = "prost-types" version = "0.13.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4759aa0d3a6232fb8dbdb97b61de2c20047c68aca932c7ed76da9d788508d670" dependencies = [ - "prost", -] - -[[package]] -name = "protobuf" -version = "2.28.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "106dd99e98437432fed6519dedecfade6a06a73bb7b2a1e019fdd2bee5778d94" - -[[package]] -name = "protobuf-codegen" -version = "2.28.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "033460afb75cf755fcfc16dfaed20b86468082a2ea24e05ac35ab4a099a017d6" -dependencies = [ - "protobuf", -] - -[[package]] -name = "protobuf-codegen-pure" -version = "2.28.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "95a29399fc94bcd3eeaa951c715f7bea69409b2445356b00519740bcd6ddd865" -dependencies = [ - "protobuf", - "protobuf-codegen", + "prost 0.13.3", ] [[package]] @@ -6566,7 +6596,7 @@ dependencies = [ "metrics", "once_cell", "parking_lot 0.12.1", - "prost", + "prost 0.13.3", "rustls 0.23.18", "tokio", "tonic", @@ -7338,7 +7368,7 @@ dependencies = [ "hyper-util", "percent-encoding", "pin-project", - "prost", + "prost 0.13.3", "rustls-native-certs 0.8.0", "rustls-pemfile 2.1.1", "tokio", @@ -7358,8 +7388,8 @@ checksum = "9557ce109ea773b399c9b9e5dca39294110b74f1f342cb347a80d1fce8c26a11" dependencies = [ "prettyplease", "proc-macro2", - "prost-build", - "prost-types", + "prost-build 0.13.3", + "prost-types 0.13.3", "quote", "syn 2.0.90", ] @@ -7892,7 +7922,7 @@ dependencies = [ "pageserver_api", "postgres_ffi", "pprof", - "prost", + "prost 0.13.3", "remote_storage", "serde", "serde_json", @@ -8349,6 +8379,7 @@ dependencies = [ "hyper-util", "indexmap 1.9.3", "indexmap 2.0.1", + "itertools 0.10.5", "itertools 0.12.1", "lazy_static", "libc", @@ -8367,7 +8398,7 @@ dependencies = [ "parquet", "prettyplease", "proc-macro2", - "prost", + "prost 0.13.3", "quote", "rand 0.8.5", "regex", diff --git a/Cargo.toml b/Cargo.toml index d11fe4f449..427d1e98ad 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -139,7 +139,7 @@ parquet = { version = "53", default-features = false, features = ["zstd"] } parquet_derive = "53" pbkdf2 = { version = "0.12.1", features = ["simple", "std"] } pin-project-lite = "0.2" -pprof = { version = "0.14", features = ["criterion", "flamegraph", "frame-pointer", "protobuf", "protobuf-codec"] } +pprof = { version = "0.14", features = ["criterion", "flamegraph", "frame-pointer", "prost-codec"] } procfs = "0.16" prometheus = {version = "0.13", default-features=false, features = ["process"]} # removes protobuf dependency prost = "0.13" diff --git a/deny.toml b/deny.toml index b551405568..ed7aa9ef9f 100644 --- a/deny.toml +++ b/deny.toml @@ -27,6 +27,10 @@ yanked = "warn" id = "RUSTSEC-2023-0071" reason = "the marvin attack only affects private key decryption, not public key signature verification" +[[advisories.ignore]] +id = "RUSTSEC-2024-0436" +reason = "The paste crate is a build-only dependency with no runtime components. It is unlikely to have any security impact." + # This section is considered when running `cargo deny check licenses` # More documentation for the licenses section can be found here: # https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html diff --git a/libs/http-utils/src/endpoint.rs b/libs/http-utils/src/endpoint.rs index f4f93df62f..5588f6d87e 100644 --- a/libs/http-utils/src/endpoint.rs +++ b/libs/http-utils/src/endpoint.rs @@ -399,12 +399,10 @@ pub async fn profile_cpu_handler(req: Request) -> Result, A // Return the report in the requested format. match format { Format::Pprof => { - let mut body = Vec::new(); - report + let body = report .pprof() .map_err(|err| ApiError::InternalServerError(err.into()))? - .write_to_vec(&mut body) - .map_err(|err| ApiError::InternalServerError(err.into()))?; + .encode_to_vec(); Response::builder() .status(200) diff --git a/workspace_hack/Cargo.toml b/workspace_hack/Cargo.toml index 183cc66ab9..4a6ab6e745 100644 --- a/workspace_hack/Cargo.toml +++ b/workspace_hack/Cargo.toml @@ -47,7 +47,8 @@ hyper-dff4ba8e3ae991db = { package = "hyper", version = "1", features = ["full"] hyper-util = { version = "0.1", features = ["client-legacy", "http1", "http2", "server", "service"] } indexmap-dff4ba8e3ae991db = { package = "indexmap", version = "1", default-features = false, features = ["std"] } indexmap-f595c2ba2a3f28df = { package = "indexmap", version = "2", features = ["serde"] } -itertools = { version = "0.12" } +itertools-5ef9efb8ec2df382 = { package = "itertools", version = "0.12" } +itertools-93f6ce9d446188ac = { package = "itertools", version = "0.10" } lazy_static = { version = "1", default-features = false, features = ["spin_no_std"] } libc = { version = "0.2", features = ["extra_traits", "use_std"] } log = { version = "0.4", default-features = false, features = ["std"] } @@ -114,7 +115,8 @@ half = { version = "2", default-features = false, features = ["num-traits"] } hashbrown = { version = "0.14", features = ["raw"] } indexmap-dff4ba8e3ae991db = { package = "indexmap", version = "1", default-features = false, features = ["std"] } indexmap-f595c2ba2a3f28df = { package = "indexmap", version = "2", features = ["serde"] } -itertools = { version = "0.12" } +itertools-5ef9efb8ec2df382 = { package = "itertools", version = "0.12" } +itertools-93f6ce9d446188ac = { package = "itertools", version = "0.10" } libc = { version = "0.2", features = ["extra_traits", "use_std"] } log = { version = "0.4", default-features = false, features = ["std"] } memchr = { version = "2" }