From 744650a15796bc16e67af9a1b30b581ab316d9f9 Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Tue, 13 Oct 2026 11:10:50 +0000 Subject: [PATCH] chore(deps): bump the rust-dependencies group with 6 updates Carries the group bump from #2706 plus the supply-chain delta audits it needs. That PR was green on Test, Lint, Examples and every WASM/Windows job; only `Audit` failed, with `cargo vet --locked` reporting ten crates unvetted. Refreshing the imported audits covers serde_spanned and the four toml crates, leaving five to review by hand. Reviewed each published package diff. None adds a dependency, a build script, or any host filesystem, network or process access, and every one of the five is a narrowing: * russh 0.63.3 -> 0.64.1 enforces that a publickey signature uses the algorithm the request announced (RFC 4252 s7, RFC 8332 s3). Before, a client could announce rsa-sha2-512 and sign with ssh-rsa (SHA-1) and the server accepted it. It also *removes* a dependency: the legacy-ed25519-pkcs8-parser feature and its yasna ASN.1 crate are gone. We use russh as a client with default features, so that feature was never enabled and the server-side bug never reachable; both changes only shrink the surface. The rest is let-chain rewrites in known_hosts/kex with identical semantics and saturating arithmetic for the cipher byte counter. No new unsafe anywhere. * napi 3.14.0 -> 3.14.2 bounds serde_json::Value conversion at 128 levels of nesting, which matters most here because the binding converts untrusted input, and fixes an aliasing violation in NativeBorrowScope by owning its storage through NonNull. * zeroize 1.9.0 -> 1.9.1 replaces Zeroizing's derived Debug with an opaque impl, so a wrapped secret no longer renders through `{:?}`; also stops double-zeroizing Vec elements and fixes an uninitialized read in the optimization_barrier fallback. * toml_parser 1.1.3 -> 1.1.5 removes its optional `unsafe` feature's get_unchecked paths outright. * syn 3.0.6 -> 3.0.7 is a one-line parser fix; signal-hook 0.4.4 -> 0.4.5 hoists a raw fd out of a borrow before an unsafe libc::send. --- Cargo.lock | 72 +++++++++++++++++++-------------------- Cargo.toml | 2 +- supply-chain/audits.toml | 30 ++++++++++++++++ supply-chain/imports.lock | 20 +++++------ 4 files changed, 77 insertions(+), 47 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 47da8f4b8..b8fc76fc7 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -253,7 +253,7 @@ checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667" dependencies = [ "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -478,7 +478,7 @@ dependencies = [ "proc-macro2", "quote", "serde", - "syn 3.0.6", + "syn 3.0.7", "tempfile", "toml", ] @@ -731,7 +731,7 @@ checksum = "fc0e56a716f1e132ff6bf4bdac1c944a3fcdc1cae65f70a4a2a1ac3b401d2d1f" dependencies = [ "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -924,7 +924,7 @@ dependencies = [ "heck", "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -1583,7 +1583,7 @@ checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8" dependencies = [ "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -1909,7 +1909,7 @@ checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44" dependencies = [ "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -2926,7 +2926,7 @@ checksum = "77060ebe535362c3da75682cd17b0431017b6e7c5661e714fc69a7ad017d1301" dependencies = [ "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -3214,9 +3214,9 @@ dependencies = [ [[package]] name = "napi" -version = "3.14.0" +version = "3.14.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "15301c22171e8397a7b17beb3c75bf486bf67ca3bdad8ea347835b770df61969" +checksum = "a4e2cf85c02d9b057898c485b824c3c416b65193689e2b7f517efc94b86ed24c" dependencies = [ "bitflags 2.13.2", "ctor", @@ -3246,7 +3246,7 @@ dependencies = [ "napi-derive-backend", "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -3259,7 +3259,7 @@ dependencies = [ "proc-macro2", "quote", "semver", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -4076,7 +4076,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2bfe0f4c752e450fc2faf62654f1c134747922825d5b04ca717b8874f41a40c0" dependencies = [ "proc-macro2", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -4666,9 +4666,9 @@ dependencies = [ [[package]] name = "russh" -version = "0.63.3" +version = "0.64.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "036204edbd199552a5b3832f63c60dcdf395dc44c7f06b4af1c0e8139cc11bce" +checksum = "ba61e87b9ec9a39a59a6bbed4c0b8ff7fb07073405b24a767a1f2c8560ac8f58" dependencies = [ "aes 0.9.3", "aws-lc-rs", @@ -5082,7 +5082,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348" dependencies = [ "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -5113,9 +5113,9 @@ dependencies = [ [[package]] name = "serde_spanned" -version = "1.1.1" +version = "1.1.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26" +checksum = "4e7523beb55eece201a2356bee0bbca0d1ab466c14c07703b2e0ee6d42cb0c2c" dependencies = [ "serde_core", ] @@ -5152,7 +5152,7 @@ checksum = "a22144e767da4ddd8416dbf383700542ffd8a5dc493dfecedfe1fe3ad03c98ae" dependencies = [ "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -5252,9 +5252,9 @@ dependencies = [ [[package]] name = "signal-hook" -version = "0.4.4" +version = "0.4.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b2a0c28ca5908dbdbcd52e6fdaa00358ab88637f8ab33e1f188dd510eb44b53d" +checksum = "b29ffa27d3d59a049bb328258de100f8012848d1b08d444e08bbc02ac468435e" dependencies = [ "libc", "signal-hook-registry", @@ -5529,9 +5529,9 @@ dependencies = [ [[package]] name = "syn" -version = "3.0.6" +version = "3.0.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee" +checksum = "d62a2e0561533f2ca2561d0cf27fd9fedb640a1bf2616ff5d5c80d99017faadc" dependencies = [ "proc-macro2", "quote", @@ -5668,7 +5668,7 @@ checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524" dependencies = [ "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -5740,7 +5740,7 @@ checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e" dependencies = [ "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -5790,9 +5790,9 @@ dependencies = [ [[package]] name = "toml" -version = "1.1.6+spec-1.1.0" +version = "1.1.8+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "920602543f0911ab71da12c50d59701da54c196d1a2bf5cb4b75667f137a406a" +checksum = "20489e00e4d8741d6be680764cc12e270655e375a20d1011e844a9c3379e678d" dependencies = [ "indexmap", "serde_core", @@ -5805,27 +5805,27 @@ dependencies = [ [[package]] name = "toml_datetime" -version = "1.1.1+spec-1.1.0" +version = "1.1.2+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7" +checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053" dependencies = [ "serde_core", ] [[package]] name = "toml_parser" -version = "1.1.3+spec-1.1.0" +version = "1.1.5+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56" +checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c" dependencies = [ "winnow", ] [[package]] name = "toml_writer" -version = "1.1.2+spec-1.1.0" +version = "1.1.3+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2" +checksum = "06bdbd8cfc056b8d2e2e85f29b56a3bdbecb527cef81eb39e3e7b98af4652770" [[package]] name = "tower" @@ -6367,7 +6367,7 @@ dependencies = [ "bumpalo", "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", "wasm-bindgen-shared", ] @@ -7063,9 +7063,9 @@ dependencies = [ [[package]] name = "zeroize" -version = "1.9.0" +version = "1.9.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e" +checksum = "e13084392c5e4bc371903e2935a5eaeed24905a7511356b883835e18a78f6879" [[package]] name = "zerotrie" @@ -7099,7 +7099,7 @@ checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da" dependencies = [ "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] diff --git a/Cargo.toml b/Cargo.toml index 8f1a9a349..90ed78ac3 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -142,7 +142,7 @@ tracing = "0.1" tower = { version = "0.5", features = ["util"] } # SSH client (for ssh/scp/sftp builtins) -russh = "0.63" +russh = "0.64" # Embedded SQLite engine (Turso, pure Rust). Upstream is BETA — gated behind # the `sqlite` feature and disabled by default; see knowledge/runtimes/sqlite-builtin.md. turso_core = "0.8.0-pre.1" diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index c7973901a..ba9ea357a 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -329,6 +329,12 @@ criteria = "safe-to-deploy" delta = "3.13.0 -> 3.14.0" notes = "Reviewed registry delta including new WASI heap-break arithmetic and allocator wrappers: serialized allocator access, checked page growth below 2 GiB, target-gated shared-memory refresh and crash reporting. Native handoff is a no-op; allocator tests cover overflow and growth failures." +[[audits.napi]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "3.14.0 -> 3.14.2" +notes = "Reviewed complete published package diff across 3.14.1 and 3.14.2: no new dependencies, no build scripts, no new host filesystem, network or process access. Four upstream fixes, all hardening. NativeBorrowScope now owns its storage through NonNull instead of aliasing a reference, removing an aliasing violation. serde_json::Value conversion is bounded at 128 levels of nesting, so deeply nested JSON from a caller can no longer recurse without limit - the change that matters most for this tree, where the binding converts untrusted input. The wasm cleanup is registered through the env cleanup hook rather than ad hoc. Object creation uses napi_define_properties on every Node version. Existing unsafe in the js_values conversions is refactored in place; no new unsafe blocks." + [[audits.napi-build]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -508,6 +514,12 @@ criteria = "safe-to-deploy" delta = "0.63.1 -> 0.63.2" notes = "Reviewed credentials redaction/zeroization; negotiated RSA certificate hashes; rekey staging and peer non-transport flood rejection/bounds. Compression drains progress with existing maximum packet limit; PTY lengths count actual entries. No new unsafe or ambient destinations." +[[audits.russh]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.63.3 -> 0.64.1" +notes = "Reviewed complete published package diff: no new dependencies, no build scripts, no new host filesystem, network or process access, and no new unsafe blocks anywhere in src. The substantive change is a server-side authentication fix: a publickey request's signature must now use the algorithm the request announced (RFC 4252 section 7, RFC 8332 section 3). Before, a client could announce rsa-sha2-512 and sign with ssh-rsa (SHA-1) and the server accepted it; the delta adds the comparison and a regression test asserting both the rejection and that a matching signature is still accepted. One dependency is removed, not added: the legacy-ed25519-pkcs8-parser feature and its yasna ASN.1 dependency are gone, so the PKCS8 path no longer falls back to a second parser on error. This tree uses russh as a client with default features, so it never enabled that feature and is not exposed to the server-side bug; both changes are a reduction in attack surface for it. Partial-success auth now carries proceed_with_methods as an Option, removing password from the offered set when none is given, and resets partial_success per request. The remainder is mechanical: let-chain rewrites in keys/known_hosts.rs and kex/dh/mod.rs with identical semantics, saturating arithmetic for the cipher byte counter, and new integration tests. Source safety review, not a cryptographic audit." + [[audits.rustls-webpki]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -520,6 +532,12 @@ criteria = "safe-to-deploy" delta = "0.103.14 -> 0.103.15" notes = "Reviewed complete runtime delta: FIPS status reports underlying AWS-LC signature implementation status. Certificate parsing, verification algorithms and input bounds unchanged." +[[audits.signal-hook]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.4.4 -> 0.4.5" +notes = "Reviewed complete published package diff: no new dependencies, no build scripts, no new host access beyond the libc signal and pipe calls the crate already made. low_level/pipe.rs hoists the raw file descriptor out of the borrowed pipe before the unsafe libc::send wake, so the descriptor is read once rather than through a borrow held across the call, and the unsafe block is narrowed to the call itself. signal_details.rs and the iterator test follow. No new unsafe blocks and no change to which signals are handled." + [[audits.smallvec]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -538,6 +556,12 @@ criteria = "safe-to-deploy" delta = "3.0.5 -> 3.0.6" notes = "Reviewed lifetime-group parse guard in expr.rs (Lifetime+End lookahead) plus version bump; token consumption stays bounded. No new unsafe, deps, build scripts, or ambient access." +[[audits.syn]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "3.0.6 -> 3.0.7" +notes = "Reviewed complete published package diff: one production change in src/expr.rs, the rest tests and a version stamp. Parsing a labelled construct now also checks that the token after the label is not '::', so 'label: ...' is no longer matched when the source actually continues with a path separator. No unsafe code, no new dependencies, no build scripts, no host access." + [[audits.thin-vec]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -759,6 +783,12 @@ criteria = "safe-to-deploy" delta = "0.14.0 -> 0.14.1" notes = "Reviewed replacement of unconditional representation reversal by PrimeFieldExt to_le_repr with correct bounds. No unsafe or algorithm-loop changes, no new ambient access." +[[audits.zeroize]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "1.9.0 -> 1.9.1" +notes = "Reviewed complete published package diff: no new dependencies, no build scripts, no host filesystem, network or process access. Three fixes, all narrowing rather than widening behaviour. Zeroizing's derived Debug is replaced with an opaque impl, so a wrapped secret no longer renders its contents through '{:?}'. The Vec impl no longer zeroizes initialized elements twice. The optimization_barrier fallback read volatile memory as u8 that could be uninitialized; it now reads MaybeUninit through a cast, removing the UB, and the internal use of that barrier is dropped. Remaining changes are the aarch64/x86 barrier modules following the same cast, a lint allowance, and the version stamp. Existing unsafe is refactored in place; no new unsafe blocks." + [[audits.zerovec]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index bde79b474..f3cbdcbfb 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -105,8 +105,8 @@ user-login = "cfallin" user-name = "Chris Fallin" [[publisher.serde_spanned]] -version = "1.1.1" -when = "2026-03-31" +version = "1.1.2" +when = "2026-10-08" user-id = 6743 user-login = "epage" user-name = "Ed Page" @@ -119,29 +119,29 @@ user-login = "Darksonn" user-name = "Alice Ryhl" [[publisher.toml]] -version = "1.1.6+spec-1.1.0" -when = "2026-09-10" +version = "1.1.8+spec-1.1.0" +when = "2026-10-09" user-id = 6743 user-login = "epage" user-name = "Ed Page" [[publisher.toml_datetime]] -version = "1.1.1+spec-1.1.0" -when = "2026-03-31" +version = "1.1.2+spec-1.1.0" +when = "2026-10-08" user-id = 6743 user-login = "epage" user-name = "Ed Page" [[publisher.toml_parser]] -version = "1.1.3+spec-1.1.0" -when = "2026-07-27" +version = "1.1.5+spec-1.1.0" +when = "2026-10-09" user-id = 6743 user-login = "epage" user-name = "Ed Page" [[publisher.toml_writer]] -version = "1.1.2+spec-1.1.0" -when = "2026-07-14" +version = "1.1.3+spec-1.1.0" +when = "2026-10-08" user-id = 6743 user-login = "epage" user-name = "Ed Page"