Repository navigation
chore(deps): bump quinn-proto to 0.11.19 to fix 5 RUSTSEC advisories - #1422
Conversation
Upgrades the transitive quinn-proto dependency (via reqwest's HTTP/3 edge) from 0.11.15 to 0.11.19, resolving RUSTSEC-2026-0338, -0339, -0340, -0341, and -0342.
This comment has been minimized.
This comment has been minimized.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@DataDog review |
There was a problem hiding this comment.
🟢 Approval recommended
The lockfile and license updates are consistent, and version 0.11.19 satisfies all five advisory fixes.
0 open findings
What changed in this PR
Updates quinn-proto to a patched release addressing five denial-of-service advisories.
Changes:
- Bumps
quinn-protofrom 0.11.15 to 0.11.19. - Adds corresponding transitive dependencies and license metadata.
| File | Description |
|---|---|
bottlecap/Cargo.lock |
Updates the dependency graph. |
bottlecap/LICENSE-3rdparty.csv |
Records newly introduced dependency licenses. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![datadog-prod-us1-4[bot]](https://avatars.githubusercontent.com/u/365230?s=60&v=4){kind=small}
There was a problem hiding this comment.
More details
The quinn-proto 0.11.19 dependency graph and third-party license entries are consistent. The completed static reviewer reported passing build, test, audit, and license CI for the reviewed commit and no reportable regressions.
🤖 Bits Code Review · Commit 4dfff9b
Overview
Bumps the transitive
quinn-protodependency from 0.11.15 to 0.11.19 inbottlecap/Cargo.lock, resolving 5 high-severity (7.5) RUSTSEC advisories:quinnenters the lockfile viareqwest's HTTP/3 dependency edge, so the fix is a lockfile-only update; noCargo.tomlchange was needed (quinn 0.11.x accepts quinn-proto 0.11.19 within its semver range). The bump adds new transitive dependencies (rand 0.10.x,chacha20) from quinn-proto's updated connection-ID handling.Testing
cargo auditinbottlecap/: exits clean, 0 vulnerabilities (the 10 pre-existing unmaintained/unsound warnings are unchanged)cargo build: passescargo test: full suite passes (0 failures)