From 1d91b9d67d6c3ee1d99a77538ae0686024f337cd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ralph=20K=C3=BCpper?= Date: Sun, 8 Nov 2026 07:37:37 +0100 Subject: [PATCH 1/2] ci: drop lapsed security exceptions; run the MongoDB fixtures on 7.0 The dependencies job fails every PR: the ctutils 0.4.4, rustls-webpki 0.103.16 and webpki-roots 1.0.10 exceptions only bridged each security fix through the seven-day soak, and all three lapsed in late October. Those versions now clear the soak on their own (soak.py: 0 exceptions). The protocol job fails every PR because the runner image moved to Linux 6.19, and every MongoDB 8.x build refuses to start there (SERVER-121912, TCMalloc violating the rseq ABI; 8.x only starts again on 7.0.14+ kernels). MongoDB 7.0 has no such check and covers every feature the suite uses: the retry rules need wire version 9, and wire version 27 appears only in synthetic fixtures. --- .github/workflows/ci.yml | 2 +- scripts/ci/policy.toml | 21 +-------------------- scripts/ci/test_servers.py | 2 +- scripts/test-servers.py | 4 +++- 4 files changed, 6 insertions(+), 23 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 24ddead2..27d41d01 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -315,7 +315,7 @@ jobs: - name: Install and verify Redis 8.4.0 with TLS run: python3 scripts/ci/install-redis.py - name: Pull MongoDB before the bounded fixture startup wait - run: docker pull mongo:8 + run: docker pull mongo:7.0 # 8.x refuses Linux 6.19+ (SERVER-121912) - name: Install WASI 0.2 adapter runtime and C toolchain run: | rustup target add --toolchain nightly-2026-08-20 wasm32-wasip2 diff --git a/scripts/ci/policy.toml b/scripts/ci/policy.toml index dbc91527..56d42383 100644 --- a/scripts/ci/policy.toml +++ b/scripts/ci/policy.toml @@ -15,23 +15,4 @@ banned = [ ] # Exact security fixes; each exception stops at registry publication + seven days. -[[security-exceptions]] -crate = "ctutils" -version = "0.4.4" -advisory = "RUSTSEC-2026-0385" -reason = "Patched constant-time mask generation and u128 comparisons" -expires = 2026-10-30 - -[[security-exceptions]] -crate = "rustls-webpki" -version = "0.103.16" -advisory = "RUSTSEC-2026-0382" -reason = "Reject distrusted emSign intermediate public keys" -expires = 2026-10-27 - -[[security-exceptions]] -crate = "webpki-roots" -version = "1.0.10" -advisory = "RUSTSEC-2026-0381" -reason = "Remove the distrusted emSign root from bundled roots" -expires = 2026-10-26 +# None are pending: every exception lapses once its fix clears the soak. diff --git a/scripts/ci/test_servers.py b/scripts/ci/test_servers.py index 365d84a1..dc3c9b6f 100644 --- a/scripts/ci/test_servers.py +++ b/scripts/ci/test_servers.py @@ -414,7 +414,7 @@ def test_docker_wrapper_records_only_its_private_container(self): self.assertEqual(args[args.index('--label') + 1], 'turnloop.fixture=' + str(tools)) self.assertEqual(args[args.index('--volume') + 1], str(root) + ':' + str(root)) self.assertEqual(args[args.index('--user') + 1], f'{os.getuid()}:{os.getgid()}') - self.assertEqual(args[-4:], ['mongod', 'mongo:8', '--port', '32123']) + self.assertEqual(args[-4:], ['mongod', 'mongo:7.0', '--port', '32123']) recorded = json.loads((tools / 'docker-fixtures.json').read_text()) self.assertEqual(recorded, [args[args.index('--name') + 1]]) self.assertTrue(recorded[0].startswith('turnloop-fixture-')) diff --git a/scripts/test-servers.py b/scripts/test-servers.py index 24b65912..63135bd9 100755 --- a/scripts/test-servers.py +++ b/scripts/test-servers.py @@ -848,7 +848,9 @@ def prepare_docker_wrappers(): import json, os, pathlib, subprocess, sys, uuid root = pathlib.Path(__file__).resolve().parents[1] name = pathlib.Path(sys.argv[0]).name -image = 'mongo:8' +# MongoDB 8.x refuses to start on Linux 6.19+ (SERVER-121912, TCMalloc rseq); +# 7.0 has no such check and covers every feature the suite uses. +image = 'mongo:7.0' container = 'turnloop-fixture-' + uuid.uuid4().hex record = root / 'docker-fixtures.json' existing = json.loads(record.read_text()) if record.exists() else [] From caa3a1a35b60abb2400666ae2ffa91425a5f3c7a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ralph=20K=C3=BCpper?= Date: Sun, 8 Nov 2026 07:44:36 +0100 Subject: [PATCH 2/2] fix(deps): zstd 0.14.3 for RUSTSEC-2026-0391, -0398, -0403 and -0410 zstd 0.13.3, zstd-safe 7.3.0 and zstd-sys 2.1.0 carry four advisories: stream data leaking into a reused context, Seekable::decompress setting a Vec length past its capacity, uninitialized memory after a failed legacy frame, and the wasm32 allocator writing over linear memory instead of failing. zstd 0.14.3, zstd-safe 8.2.0 and zstd-sys 2.1.2 (all published 2026-10-16, past the soak) fix them; turnloop-http needs no source change and exposes no zstd type. --- Cargo.lock | 12 ++++++------ Cargo.toml | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 46400283..dacc4396 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2459,27 +2459,27 @@ checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b" [[package]] name = "zstd" -version = "0.13.3" +version = "0.14.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a" +checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70" dependencies = [ "zstd-safe", ] [[package]] name = "zstd-safe" -version = "7.3.0" +version = "8.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "64d80649ab6db9d9f6f9c80a40becd948eda4714a0a5ac8c4d157a32231c7882" +checksum = "ded520f16b29e1a9b771c722221b2b0a0398c2316d9bb3c42b458a5414d7434b" dependencies = [ "zstd-sys", ] [[package]] name = "zstd-sys" -version = "2.1.0+zstd.1.5.7" +version = "2.1.2+zstd.1.5.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0ef0a8027ec3ee71300ab3bcbcd0393f434aa72b91ca6d635a39941deae8eea0" +checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3" dependencies = [ "cc", "pkg-config", diff --git a/Cargo.toml b/Cargo.toml index 5253cfe4..6af83fc2 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -51,7 +51,7 @@ ring = "0.17" rustls-pki-types = "1" rcgen = { version = "0.13", default-features = false, features = ["ring", "pem"] } tungstenite = { version = "0.30", default-features = false, features = ["handshake"] } -zstd = { version = "0.13", default-features = false } +zstd = { version = "0.14", default-features = false } twox-hash = { version = "2", default-features = false, features = ["xxhash64"] } fastrand = "2" rand = { version = "0.8", features = ["small_rng"] }