jlxq0/jmap-mcp
Watch
1
0
Fork
You've already forked jmap-mcp
 0
Code Issues 1 Pull requests Projects Releases 1 Packages 1 Wiki Activity Actions

fix(deps): upgrade SHA-256 chain to patched block-buffer0.12.1 #46

Merged
jlxq0 merged 1 commit from fix/block-buffer-advisory-20261029 into main 2026-10-28 17:23:00 +00:00
Conversation 0 Commits 1 Files changed 5 +58 -40
jlxq0 commented 2026-10-28 17:16:30 +00:00
Owner

OSV blocks the current block-buffer0.10.4 dependency for GHSA-qwgh-2vcv-g2f7 even though RustSec audit passes. Upgrade the sole reverse chain to released sha2 0.11.1 → digest0.11.3 → patched block-buffer0.12.1, retaining pinned Rust1.93.0 and all advisory gates. Only required crypto dependencies change; old generic-array/version_check and cpufeatures0.2 are removed. No application runtime logic, credentials, profiles or deployment changes.

Validation: pinned fmt/clippy(all targets/features, locked) and244tests pass. Fixed token-hash vectors (including Unicode and block/padding boundaries) pass before and after upgrade. Cargo audit0vulnerabilities (existing allowed chacha20 yankedwarning), deny bans/licenses/sources pass. Checksum-pinned OSV2.5.1 reports No issues found. Fresh independent Claude Code print review (claude-opus-5-5), separate read-only context, APPROVE exact 54eb8b2c2f52dd4848bd84daa1596596f933f613; all ACs pass, no blocking security/data-loss issue. Forgejo CI156 all success: cargo (including OSV), tag-ancestry and Docker build/scan. Reviewer did not run tests; cited log provenance plus exact-headCI provides execution evidence. This prerequisite is separate from draft safety PR45; no release/tag/deploy performed.

OSV blocks the current `block-buffer`0.10.4 dependency for GHSA-qwgh-2vcv-g2f7 even though RustSec audit passes. Upgrade the sole reverse chain to released sha2 0.11.1 → digest0.11.3 → patched block-buffer0.12.1, retaining pinned Rust1.93.0 and all advisory gates. Only required crypto dependencies change; old generic-array/version_check and cpufeatures0.2 are removed. No application runtime logic, credentials, profiles or deployment changes. Validation: pinned fmt/clippy(all targets/features, locked) and244tests pass. Fixed token-hash vectors (including Unicode and block/padding boundaries) pass before and after upgrade. Cargo audit0vulnerabilities (existing allowed chacha20 yankedwarning), deny bans/licenses/sources pass. Checksum-pinned OSV2.5.1 reports No issues found. Fresh independent Claude Code print review (claude-opus-5-5), separate read-only context, APPROVE exact `54eb8b2c2f52dd4848bd84daa1596596f933f613`; all ACs pass, no blocking security/data-loss issue. Forgejo [CI156](https://forge.oddie.app/jlxq0/jmap-mcp/actions/runs/156) all success: cargo (including OSV), tag-ancestry and Docker build/scan. Reviewer did not run tests; cited log provenance plus exact-headCI provides execution evidence. This prerequisite is separate from draft safety PR45; no release/tag/deploy performed.
fix(deps): move SHA-256 chain to patched block-buffer release
All checks were successful
CI / tag-ancestry (pull_request) Successful in 2s
Details
CI / cargo (pull_request) Successful in 1m44s
Details
CI / docker (pull_request) Successful in 2m57s
Details
54eb8b2c2f
jlxq0 merged commit 737e63ab1e into main 2026-10-28 17:23:00 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
waiting-on-julian
Blocked on Julian. The ask is in the issue.

No labels
waiting-on-julian
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jlxq0/jmap-mcp!46
No description provided.