Repository navigation
ci: lapsed security exceptions, MongoDB 7.0 fixtures, zstd 0.14.3 for four advisories - #134
Merged
Merged
Conversation
The dependencies job fails every PR: the ctutils 0.4.4, rustls-webpki 0.103.16 and webpki-roots 1.0.10 exceptions only bridged each security fix through the seven-day soak, and all three lapsed in late October. Those versions now clear the soak on their own (soak.py: 0 exceptions). The protocol job fails every PR because the runner image moved to Linux 6.19, and every MongoDB 8.x build refuses to start there (SERVER-121912, TCMalloc violating the rseq ABI; 8.x only starts again on 7.0.14+ kernels). MongoDB 7.0 has no such check and covers every feature the suite uses: the retry rules need wire version 9, and wire version 27 appears only in synthetic fixtures.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 43 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
zstd 0.13.3, zstd-safe 7.3.0 and zstd-sys 2.1.0 carry four advisories: stream data leaking into a reused context, Seekable::decompress setting a Vec length past its capacity, uninitialized memory after a failed legacy frame, and the wasm32 allocator writing over linear memory instead of failing. zstd 0.14.3, zstd-safe 8.2.0 and zstd-sys 2.1.2 (all published 2026-10-16, past the soak) fix them; turnloop-http needs no source change and exposes no zstd type.
proggeramlug
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On
main, two jobs fail for every PR, including Dependabot's (#129, #130):dependencies:ERROR: Expired security exception: ('ctutils', '0.4.4'); remove it from policy.toml. The three exceptions (ctutils 0.4.4, rustls-webpki 0.103.16, webpki-roots 1.0.10) only covered each security fix while it was inside the seven-day soak, and all three expired between Oct 26 and Oct 30. Those versions now clear the soak on their own:python3 scripts/ci/soak.pyreportsPASS soak: 251 locked registry versions; 0 security exceptions.protocol:MongoDB cannot start: Linux kernel versions 6.19 and newer has a known incompatibility with this version of MongoDB(SERVER-121912). The runner image moved to a 6.19 kernel. Every MongoDB 8.x build refuses to start there, and the ticket was closed with no fixed 8.x release: a follow-up only lets 8.x start again on 7.0.14+ kernels. The fixtures therefore pinmongo:7.0(wire version 21), which covers everything the suite uses: the retry rules need wire version 9, and wire version 27 appears only in synthetic fixtures.python3 scripts/ci/test_servers.pypasses (19 tests).dependenciesagain: four new advisories. RUSTSEC-2026-0391, -0398, -0403 and -0410 affect zstd 0.13.3, zstd-safe 7.3.0 and zstd-sys 2.1.0. The PR now bumps to zstd 0.14.3, zstd-safe 8.2.0 and zstd-sys 2.1.2, all published 2026-10-16, so they clear the soak without an exception.turnloop-httpneeds no source change and exposes no zstd type in its API. Locally:cargo deny --all-features checkshows advisories, bans, licenses and sources all ok; the soak check passes; the turnloop-http and turnloop-zstd-decoder tests pass 167/167.