Repository navigation
Conversation
RustSec added five advisories against quinn-proto 0.11.15 on 2026-10-12, so cargo audit fails on main. quinn-proto is in the lock file only as an optional dependency of reqwest (HTTP/3), and no build compiles it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ndencies Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…-rs exists The fix is in rustls 0.23.46, which requires aws-lc-rs >= 1.18 and so AWS-LC-FIPS 4.x, the same blocker as for RUSTSEC-2026-0285. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
lym953
marked this pull request as ready for review
October 14, 2026 20:04
lym953
requested review from
Lewis-E and
clifordshelton
and removed request for
a team
October 14, 2026 20:04
Lewis-E
approved these changes
Oct 14, 2026
|
The description says we can't upgrade rustls because the newer version needs aws-lc-rs 1.18+, which uses a FIPS module that isn't certified yet. But this repo is already on aws-lc-rs 1.18.1. You can check with I think we need to pick one:
|
|
For RUSTSEC-2026-0349, the description says nothing in our code sets the key exchange groups. That means we use rustls's defaults, and with aws-lc-rs the default includes the post-quantum group this advisory is about. So we may be affected by default. Could we check before ignoring it? |
lym953
marked this pull request as draft
October 15, 2026 17:47
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #182, which fixes the
quinn-protoadvisories. Review that PR first.Problem
The Audit job fails on every branch because of four advisories against the TLS library
rustls0.23.44, which RustSec added on 2026-10-14:Debugimpls for client session values expose TLS secretsOnly
rustls0.23.46 fixes them. That version requiresaws-lc-rs1.18 or later, which uses AWS-LC-FIPS 4.x, and that module has no FIPS 140-3 certification yet. This is the same reason that the repository already ignores RUSTSEC-2026-0285.This PR
This PR adds the four advisories to the ignore list in
.cargo/audit.toml, with the same reason and removal rule as RUSTSEC-2026-0285.Three of the four need a feature that this repository does not use:
ClientSessionStore, and no code uses one.brotlifeature ofrustls, andCargo.lockdoes not havebrotliin the dependencies ofrustls.RUSTSEC-2026-0349 can apply to a client that uses a post-quantum key exchange group. No code here sets the groups, and I did not check the default groups of the FIPS provider. The advisory says that its effect is the loss of post-quantum protection, not a key compromise.
Testing
cargo auditwith the advisory database of 2026-10-14rustlsvulnerabilitiesunsafe-libyaml,lru🤖 Generated with Claude Code