fix(deps): resolve RustSec dependency advisories

- bump event-listener to 5.4.2 for RUSTSEC-2026-0221
- use the AWS SDK modern HTTPS client to remove rustls-webpki 0.101 affected by RUSTSEC-2026-0098, RUSTSEC-2026-0099, and RUSTSEC-2026-0104

Co-authored-by: Codex <noreply@openai.com>
This commit is contained in:
zyycn
2026-08-01 23:53:55 +08:00
co-authored by Codex
parent 56f7ddd1dc
commit 0d2c648422
2 changed files with 34 additions and 164 deletions
+33 -163
View File
@@ -290,19 +290,15 @@ dependencies = [
"aws-smithy-runtime-api",
"aws-smithy-types",
"bytes",
"crypto-bigint",
"form_urlencoded",
"hex",
"hmac 0.13.0",
"http 0.2.12",
"http 1.4.2",
"p256",
"percent-encoding",
"sha2 0.11.0",
"subtle",
"time",
"tracing",
"zeroize",
]
[[package]]
@@ -379,23 +375,17 @@ dependencies = [
"aws-smithy-async",
"aws-smithy-runtime-api",
"aws-smithy-types",
"h2 0.3.27",
"h2 0.4.15",
"http 0.2.12",
"h2",
"http 1.4.2",
"http-body 0.4.6",
"hyper 0.14.32",
"hyper 1.10.1",
"hyper-rustls 0.24.2",
"hyper-rustls 0.27.9",
"hyper",
"hyper-rustls",
"hyper-util",
"pin-project-lite",
"rustls 0.21.12",
"rustls 0.23.42",
"rustls",
"rustls-native-certs",
"rustls-pki-types",
"tokio",
"tokio-rustls 0.26.4",
"tokio-rustls",
"tower",
"tracing",
]
@@ -553,7 +543,7 @@ dependencies = [
"http 1.4.2",
"http-body 1.0.1",
"http-body-util",
"hyper 1.10.1",
"hyper",
"hyper-util",
"itoa",
"matchit",
@@ -858,15 +848,6 @@ version = "0.4.32"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "cc14f565cf027a105f7a44ccf9e5b424348421a1d8952a8fc9d499d313107789"
[[package]]
name = "concurrent-queue"
version = "2.5.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
dependencies = [
"crossbeam-utils",
]
[[package]]
name = "config"
version = "0.15.25"
@@ -1349,11 +1330,10 @@ dependencies = [
[[package]]
name = "event-listener"
version = "5.4.1"
version = "5.4.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
dependencies = [
"concurrent-queue",
"parking",
"pin-project-lite",
]
@@ -1773,25 +1753,6 @@ dependencies = [
"subtle",
]
[[package]]
name = "h2"
version = "0.3.27"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0beca50380b1fc32983fc1cb4587bfa4bb9e78fc259aad4a0032d2080309222d"
dependencies = [
"bytes",
"fnv",
"futures-core",
"futures-sink",
"futures-util",
"http 0.2.12",
"indexmap",
"slab",
"tokio",
"tokio-util",
"tracing",
]
[[package]]
name = "h2"
version = "0.4.15"
@@ -1988,30 +1949,6 @@ dependencies = [
"typenum",
]
[[package]]
name = "hyper"
version = "0.14.32"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "41dfc780fdec9373c01bae43289ea34c972e40ee3c9f6b3c8801a35f35586ce7"
dependencies = [
"bytes",
"futures-channel",
"futures-core",
"futures-util",
"h2 0.3.27",
"http 0.2.12",
"http-body 0.4.6",
"httparse",
"httpdate",
"itoa",
"pin-project-lite",
"socket2 0.5.10",
"tokio",
"tower-service",
"tracing",
"want",
]
[[package]]
name = "hyper"
version = "1.10.1"
@@ -2022,7 +1959,7 @@ dependencies = [
"bytes",
"futures-channel",
"futures-core",
"h2 0.4.15",
"h2",
"http 1.4.2",
"http-body 1.0.1",
"httparse",
@@ -2034,21 +1971,6 @@ dependencies = [
"want",
]
[[package]]
name = "hyper-rustls"
version = "0.24.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
dependencies = [
"futures-util",
"http 0.2.12",
"hyper 0.14.32",
"log",
"rustls 0.21.12",
"tokio",
"tokio-rustls 0.24.1",
]
[[package]]
name = "hyper-rustls"
version = "0.27.9"
@@ -2056,12 +1978,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
dependencies = [
"http 1.4.2",
"hyper 1.10.1",
"hyper",
"hyper-util",
"rustls 0.23.42",
"rustls",
"rustls-native-certs",
"tokio",
"tokio-rustls 0.26.4",
"tokio-rustls",
"tower-service",
]
@@ -2077,12 +1999,12 @@ dependencies = [
"futures-util",
"http 1.4.2",
"http-body 1.0.1",
"hyper 1.10.1",
"hyper",
"ipnet",
"libc",
"percent-encoding",
"pin-project-lite",
"socket2 0.6.4",
"socket2",
"tokio",
"tower-service",
"tracing",
@@ -2755,7 +2677,7 @@ dependencies = [
"jsonwebtoken",
"reqwest",
"roxmltree",
"rustls 0.23.42",
"rustls",
"rustls-native-certs",
"rustls-pki-types",
"secrecy",
@@ -2834,8 +2756,8 @@ dependencies = [
"quinn-proto",
"quinn-udp",
"rustc-hash",
"rustls 0.23.42",
"socket2 0.6.4",
"rustls",
"socket2",
"thiserror",
"tokio",
"tracing",
@@ -2855,7 +2777,7 @@ dependencies = [
"rand_pcg",
"ring",
"rustc-hash",
"rustls 0.23.42",
"rustls",
"rustls-pki-types",
"slab",
"thiserror",
@@ -2873,7 +2795,7 @@ dependencies = [
"cfg_aliases",
"libc",
"once_cell",
"socket2 0.6.4",
"socket2",
"tracing",
"windows-sys 0.61.2",
]
@@ -2992,7 +2914,7 @@ dependencies = [
"pin-project-lite",
"ryu",
"sha1_smol",
"socket2 0.6.4",
"socket2",
"tokio",
"tokio-util",
"url",
@@ -3055,19 +2977,19 @@ dependencies = [
"cookie_store",
"futures-core",
"futures-util",
"h2 0.4.15",
"h2",
"http 1.4.2",
"http-body 1.0.1",
"http-body-util",
"hyper 1.10.1",
"hyper-rustls 0.27.9",
"hyper",
"hyper-rustls",
"hyper-util",
"js-sys",
"log",
"percent-encoding",
"pin-project-lite",
"quinn",
"rustls 0.23.42",
"rustls",
"rustls-native-certs",
"rustls-pki-types",
"serde",
@@ -3075,7 +2997,7 @@ dependencies = [
"serde_urlencoded",
"sync_wrapper",
"tokio",
"tokio-rustls 0.26.4",
"tokio-rustls",
"tokio-util",
"tower",
"tower-http 0.6.11",
@@ -3148,18 +3070,6 @@ dependencies = [
"windows-sys 0.61.2",
]
[[package]]
name = "rustls"
version = "0.21.12"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
dependencies = [
"log",
"ring",
"rustls-webpki 0.101.7",
"sct",
]
[[package]]
name = "rustls"
version = "0.23.42"
@@ -3170,7 +3080,7 @@ dependencies = [
"once_cell",
"ring",
"rustls-pki-types",
"rustls-webpki 0.103.13",
"rustls-webpki",
"subtle",
"zeroize",
]
@@ -3197,16 +3107,6 @@ dependencies = [
"zeroize",
]
[[package]]
name = "rustls-webpki"
version = "0.101.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
dependencies = [
"ring",
"untrusted 0.9.0",
]
[[package]]
name = "rustls-webpki"
version = "0.103.13"
@@ -3255,16 +3155,6 @@ version = "1.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
[[package]]
name = "sct"
version = "0.7.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
dependencies = [
"ring",
"untrusted 0.9.0",
]
[[package]]
name = "sec1"
version = "0.7.3"
@@ -3515,16 +3405,6 @@ dependencies = [
"serde",
]
[[package]]
name = "socket2"
version = "0.5.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
dependencies = [
"libc",
"windows-sys 0.52.0",
]
[[package]]
name = "socket2"
version = "0.6.4"
@@ -3607,7 +3487,7 @@ dependencies = [
"log",
"memchr",
"percent-encoding",
"rustls 0.23.42",
"rustls",
"serde",
"serde_json",
"sha2 0.10.9",
@@ -3937,7 +3817,7 @@ dependencies = [
"mio",
"pin-project-lite",
"signal-hook-registry",
"socket2 0.6.4",
"socket2",
"tokio-macros",
"windows-sys 0.61.2",
]
@@ -3953,23 +3833,13 @@ dependencies = [
"syn 2.0.119",
]
[[package]]
name = "tokio-rustls"
version = "0.24.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
dependencies = [
"rustls 0.21.12",
"tokio",
]
[[package]]
name = "tokio-rustls"
version = "0.26.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
dependencies = [
"rustls 0.23.42",
"rustls",
"tokio",
]
@@ -3991,11 +3861,11 @@ source = "git+https://github.com/openai-oss-forks/tokio-tungstenite?rev=0e5b2d73
dependencies = [
"futures-util",
"log",
"rustls 0.23.42",
"rustls",
"rustls-native-certs",
"rustls-pki-types",
"tokio",
"tokio-rustls 0.26.4",
"tokio-rustls",
"tungstenite 0.27.0",
]
@@ -4210,7 +4080,7 @@ dependencies = [
"httparse",
"log",
"rand 0.9.4",
"rustls 0.23.42",
"rustls",
"rustls-pki-types",
"sha1 0.10.7",
"thiserror",
@@ -4673,7 +4543,7 @@ dependencies = [
"futures",
"http 1.4.2",
"http-body-util",
"hyper 1.10.1",
"hyper",
"hyper-util",
"log",
"once_cell",
+1 -1
View File
@@ -14,7 +14,7 @@ path = "tests/main.rs"
[dependencies]
async-trait = "0.1.89"
aws-credential-types = "1.2"
aws-sdk-s3 = { version = "1.140", features = ["rt-tokio", "rustls"] }
aws-sdk-s3 = { version = "1.140", default-features = false, features = ["rt-tokio", "default-https-client"] }
aws-smithy-runtime-api = "1.14"
aws-smithy-types = "1.6"
chrono = "0.4.45"