Skip to content

chore(deps): update vulnerable transitive dependencies - #1508

Merged
github-actions[bot] merged 1 commit into
mainfrom
ci/cargo-audit-fixes-2
Oct 26, 2026
Merged

github-actions[bot] merged 1 commit into
mainfrom
ci/cargo-audit-fixes-2

Conversation

@Smartdevs17

Copy link
Copy Markdown
Owner

Refreshes the lockfile so the core CI security audit passes.

  • Update quinn-proto, rustls, rustls-webpki, webpki roots, h2, and spin.
  • Ignore RUSTSEC-2026-0387 (crypto-bigint) because the fix requires a new major version not compatible with the Soroban SDK's k256/elliptic-curve stack.

Verified locally with cargo audit and cargo audit --deny warnings.

Refresh quinn-proto, rustls, rustls-webpki, webpki roots, h2, and spin in Cargo.lock so cargo audit passes. Ignore the unfixable crypto-bigint advisory pulled in by the Soroban SDK's k256/elliptic-curve stack.
@vercel

vercel Bot commented Oct 26, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
landing Ready Ready Preview Oct 26, 2026 2:04pm UTC

@github-actions
github-actions Bot merged commit f6ec357 into main Oct 26, 2026
14 of 25 checks passed
@Smartdevs17
Smartdevs17 deleted the ci/cargo-audit-fixes-2 branch October 26, 2026 14:18

This branch was successfully deployed

1 active deployment
Preview — 8db323bc Deployed Oct 26, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant