Skip to content

chore(deps): fix RUSTSEC-2026-0385/0386/0387 #844

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
raymondk merged 5 commits into from
Oct 26, 2026
Merged

chore(deps): fix RUSTSEC-2026-0385/0386/0387 #844

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
3b49190
chore(deps): bump ctutils to 0.4.6 for RUSTSEC-2026-0385
lwshang Oct 26, 2026
30d7242
chore(deps): bump tokio to 1.54.1 for RUSTSEC-2026-0386
lwshang Oct 26, 2026
a364562
chore(deps): move to the RustCrypto 0.14 stack for RUSTSEC-2026-0387
lwshang Oct 26, 2026
19edb9c
Revert "chore(deps): move to the RustCrypto 0.14 stack for RUSTSEC-20…
lwshang Oct 26, 2026
fe4e545
chore(deps): ignore RUSTSEC-2026-0387 until ic-agent moves to the Rus…
lwshang Oct 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 21 additions & 21 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

16 changes: 12 additions & 4 deletions deny.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,13 +8,21 @@
exclude-dev = true

[advisories]
# Vulnerabilities are always denied. Informational advisories are transitive
# crates we do not pick, usually with no patched version, and GHSA omits them so
# Dependabot never raises them either. Replaces the stale hand-maintained ignore
# list in .cargo/audit.toml.
# Vulnerabilities are denied, except one listed in `ignore` below, which needs
# a fix already in progress and a link to it. Informational advisories are
# transitive crates we do not pick, usually with no patched version, and GHSA
# omits them so Dependabot never raises them either. Replaces the stale
# hand-maintained ignore list in .cargo/audit.toml.
unmaintained = "none"
# Not a vulnerability, and usually clears on the next `cargo update`.
yanked = "warn"
ignore = [
# crypto-bigint 0.5 has no patched release, and ic-agent's elliptic-curve
# 0.13 stack pins it. A timing side channel is a remote risk for a local CLI
# that signs only with the user's own keys. Remove once ic-agent ships the
# 0.14 stack (dfinity/agent-rs#745) and icp-cli moves to it.
{ id = "RUSTSEC-2026-0387", reason = "crypto-bigint 0.5 pinned by ic-agent; fix in dfinity/agent-rs#745" },
]

[licenses]
# Binary distribution, so: attribution-only terms, plus MPL-2.0, whose copyleft
Expand Down
Loading