Repository navigation
Update sfio-rustls-config to 0.4.2 - #355
Merged
Merged
Conversation
Updates `sfio-rustls-config` to 0.4.2 (stepfunc/rustls-config#7), which moves it to `pkcs8` 0.11 and the `digest` 0.11 stack. The lockfile now has only `block-buffer` 0.12.1, so `osv-scanner.toml`, which ignored [GHSA-qwgh-2vcv-g2f7](GHSA-qwgh-2vcv-g2f7) against 0.10.4 (#354), is removed. **Is rodbus exposed? No**, as #354 explains: the inline cursor the advisory describes doesn't exist in `block-buffer` 0.10, and rodbus reaches it only when TLS decrypts a password-protected private key file (`sfio-rustls-config` `PrivateKey::decrypt_from_pem`). So this has no changelog entry, and the "not affected" entry from #354 is removed. **`allowed.json`:** the update adds crates to the bindings (`aead`, `aes-gcm`, `cmov`, `cpubits`, `ctr`, `ctutils`, `ghash`, `hybrid-array`, `polyval`, `universal-hash`; all MIT OR Apache-2.0, reviewed as MIT like the rest of RustCrypto), so they get entries. The copyright lines of the crates whose versions changed are refreshed from their current license files. `generic-array` and `version_check` are no longer in the lockfile and are removed. **CLAUDE.md:** a dependency advisory gets a changelog entry only when it matters to users, Rust or bindings. It also notes that new crates in the bindings need `allowed.json` entries, which only the packaging job checks. Checked locally: fmt; workspace clippy; `cargo test -p rodbus --features ffi,serialization`; the `tls-aws-lc` build; `cargo +1.94 check`; cargo-audit; OSV-Scanner (pinned image) with no findings; `bom-tools` 0.3.0 license reports and SBOMs for `rodbus-ffi-c` and `rodbus-ffi-java` on x86_64 Linux. The packaging job, which checks every target, runs on this branch through `workflow_dispatch`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates
sfio-rustls-configto 0.4.2 (stepfunc/rustls-config#7), which moves it topkcs80.11 and thedigest0.11 stack. The lockfile now has onlyblock-buffer0.12.1, soosv-scanner.toml, which ignored GHSA-qwgh-2vcv-g2f7 against 0.10.4 (#354), is removed.Is rodbus exposed? No, as #354 explains: the inline cursor the advisory describes doesn't exist in
block-buffer0.10, and rodbus reaches it only when TLS decrypts a password-protected private key file (sfio-rustls-configPrivateKey::decrypt_from_pem). So this has no changelog entry, and the "not affected" entry from #354 is removed.allowed.json: the update adds crates to the bindings (aead,aes-gcm,cmov,cpubits,ctr,ctutils,ghash,hybrid-array,polyval,universal-hash; all MIT OR Apache-2.0, reviewed as MIT like the rest of RustCrypto), so they get entries. The copyright lines of the crates whose versions changed are refreshed from their current license files.generic-arrayandversion_checkare no longer in the lockfile and are removed.CLAUDE.md: a dependency advisory gets a changelog entry only when it matters to users, Rust or bindings. It also notes that new crates in the bindings need
allowed.jsonentries, which only the packaging job checks.Checked locally: fmt; workspace clippy;
cargo test -p rodbus --features ffi,serialization; thetls-aws-lcbuild;cargo +1.94 check; cargo-audit; OSV-Scanner (pinned image) with no findings;bom-tools0.3.0 license reports and SBOMs forrodbus-ffi-candrodbus-ffi-javaon x86_64 Linux. The packaging job, which checks every target, runs on this branch throughworkflow_dispatch.