jlxq0/jmap-mcp
Watch
1
0
Fork
You've already forked jmap-mcp
 0
Code Issues 1 Pull requests Projects Releases 1 Packages 1 Wiki Activity Actions

fix(deps): patch rustls, webpki and tokio advisories (v0.2.24) #44

Merged
jlxq0 merged 2 commits from fix/t_189f1358-audit into main 2026-10-24 03:08:32 +00:00
Conversation 0 Commits 2 Files changed 8 +66 -21
jlxq0 commented 2026-10-24 02:53:02 +00:00
Owner

cargo audit fails on main (256e134, v0.2.23) with nine advisories published after that release. The 2026-10-07 green CI predates them.

Changes

  • rustls 0.23.45 -> 0.23.46 (RUSTSEC-2026-0346/0347/0348/0349)
  • rustls-webpki 0.103.14 -> 0.103.16 (RUSTSEC-2026-0382, distrusted intermediates accepted)
  • webpki-roots 1.0.9 -> 1.0.11 (RUSTSEC-2026-0381)
  • tokio 1.53.1 -> 1.53.3 (RUSTSEC-2026-0386, unsound AsyncFd; never called here). This is the smallest patched release; 1.54 brings a timer rework and new panic paths into a panic = "abort" binary.
  • quinn-proto 0.11.17 -> 0.11.19 (RUSTSEC-2026-0338/0340/0343). Lockfile-only; cargo tree -i --target all prints nothing.
  • Version 0.2.24. README, compose.yaml and SECURITY.md no longer name 0.2.14. The README now notes that GHCR lags the Forge until the GitHub mirror syncs.

The lock diff is the five version/checksum pairs plus the jmap-mcp version. cargo update -p re-resolved tempfile's getrandom edge and the windows-sys edges of errno, quinn-udp, rustix and tempfile; those were restored by hand, and cargo metadata --locked and build --locked pass. AGENTS.md records the recurrence.

Verification (rustc 1.93.0, the MSRV pin)

  • cargo fmt --check, cargo clippy --all-targets --all-features --locked -D warnings: pass
  • cargo test --all-features --locked: 243 passed, 0 failed
  • cargo audit: red on main (9 vulnerabilities) -> 0 vulnerabilities; one existing allowed warning (chacha20 0.10.1 yanked)
  • cargo deny check bans licenses sources: pass
  • OSV batch query (covers GitHub advisories) over all 277 locked registry crates: 0 hits. A positive control on rustls 0.23.45, rustls-webpki 0.103.14 and tokio 1.53.1 returned their advisories.
  • Independent review: APPROVE, then APPROVE again after one rework (tokio 1.54.1 -> 1.53.3).

Not in this PR (from audit t_35e1584a)

  • GitHub mirror stuck at ef340be, GHCR at 0.2.21: needs a mirror admin to read last_error.
  • reconciled delegation branch: unshipped, needs a keep/drop decision.
  • query_email_ids empty-last-page acceptance against Stalwart: needs a synthetic mailbox.
  • CHANGELOG has no entries for 0.2.15-0.2.22.

🤖 Generated with Claude Code

https://claude.ai/code/session_01V8oqYHZZhxVCAAFUpDdrWK

`cargo audit` fails on `main` (256e134, v0.2.23) with nine advisories published after that release. The 2026-10-07 green CI predates them. ## Changes - rustls 0.23.45 -> 0.23.46 (RUSTSEC-2026-0346/0347/0348/0349) - rustls-webpki 0.103.14 -> 0.103.16 (RUSTSEC-2026-0382, distrusted intermediates accepted) - webpki-roots 1.0.9 -> 1.0.11 (RUSTSEC-2026-0381) - tokio 1.53.1 -> 1.53.3 (RUSTSEC-2026-0386, unsound `AsyncFd`; never called here). This is the smallest patched release; 1.54 brings a timer rework and new panic paths into a `panic = "abort"` binary. - quinn-proto 0.11.17 -> 0.11.19 (RUSTSEC-2026-0338/0340/0343). Lockfile-only; `cargo tree -i --target all` prints nothing. - Version 0.2.24. README, `compose.yaml` and SECURITY.md no longer name 0.2.14. The README now notes that GHCR lags the Forge until the GitHub mirror syncs. The lock diff is the five `version`/`checksum` pairs plus the jmap-mcp version. `cargo update -p` re-resolved `tempfile`'s `getrandom` edge and the `windows-sys` edges of errno, quinn-udp, rustix and tempfile; those were restored by hand, and `cargo metadata --locked` and `build --locked` pass. AGENTS.md records the recurrence. ## Verification (rustc 1.93.0, the MSRV pin) - `cargo fmt --check`, `cargo clippy --all-targets --all-features --locked -D warnings`: pass - `cargo test --all-features --locked`: 243 passed, 0 failed - `cargo audit`: red on `main` (9 vulnerabilities) -> 0 vulnerabilities; one existing allowed warning (chacha20 0.10.1 yanked) - `cargo deny check bans licenses sources`: pass - OSV batch query (covers GitHub advisories) over all 277 locked registry crates: 0 hits. A positive control on rustls 0.23.45, rustls-webpki 0.103.14 and tokio 1.53.1 returned their advisories. - Independent review: APPROVE, then APPROVE again after one rework (tokio 1.54.1 -> 1.53.3). ## Not in this PR (from audit t_35e1584a) - GitHub mirror stuck at `ef340be`, GHCR at 0.2.21: needs a mirror admin to read `last_error`. - `reconciled` delegation branch: unshipped, needs a keep/drop decision. - `query_email_ids` empty-last-page acceptance against Stalwart: needs a synthetic mailbox. - CHANGELOG has no entries for 0.2.15-0.2.22. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01V8oqYHZZhxVCAAFUpDdrWK
fix(deps): patch rustls, webpki and tokio advisories (v0.2.24)
Some checks failed
CI / cargo (pull_request) Failing after 2s
Details
CI / tag-ancestry (pull_request) Successful in 2s
Details
CI / docker (pull_request) Has been skipped
Details
ad34dd75ee 
cargo audit failed on main with nine advisories published after v0.2.23:
rustls 0.23.45 (RUSTSEC-2026-0346/0347/0348/0349), rustls-webpki 0.103.14
(0382), webpki-roots 1.0.9 (0381) and quinn-proto 0.11.17 (0338/0340/0343,
lockfile-only). tokio 1.53.1 also carried the unsound AsyncFd advisory
(0386); 1.53.3 is the smallest patched release and avoids 1.54's timer
rework and new panic paths in a panic=abort binary. Targeted updates only;
the getrandom and windows-sys edges cargo re-resolved alongside were
restored, so the lock diff is the five crates and nothing else.

Refresh README, compose.yaml and SECURITY.md, which still named 0.2.14 as
the current and only supported release.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V8oqYHZZhxVCAAFUpDdrWK
ci: re-pin rust-toolchain to a master commit the mirror can resolve
All checks were successful
CI / tag-ancestry (pull_request) Successful in 2s
Details
CI / cargo (pull_request) Successful in 3m49s
Details
CI / docker (pull_request) Successful in 2m37s
Details
fb880662b5 
CI / cargo failed on PR #44 in 2 s: "could not determine the commit ID of
4360b52…". That SHA sat on upstream's `stable` branch, which dtolnay
regenerates and force-pushes; after the Forge mirror synced on 2026-10-23
no ref reached it, so every run (main included) fails before its first
step. The commits API still answers 200 for the uncollected object, which
is why the documented check passes while the runner cannot fetch it.

683b588 is the current master tip, identical on GitHub and the mirror, and
master is not force-pushed. The diff since the last reviewed master is
input-handling hardening (#187) and patch-release tables.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V8oqYHZZhxVCAAFUpDdrWK
jlxq0 merged commit 53033202c6 into main 2026-10-24 03:08:32 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
waiting-on-julian
Blocked on Julian. The ask is in the issue.

No labels
waiting-on-julian
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jlxq0/jmap-mcp!44
No description provided.