Repository navigation
build(deps): openssl 0.10.80 for three RustSec advisories; rmcp advisory assessed not applicable - #1220
Merged
Conversation
…ory assessed not applicable Cargo Deny (a CI Gate need) has been red on main and on every PR since four new advisories were published: - RUSTSEC-2026-0474, -0476, -0477 (openssl 0.10.78: non-UTF-8 &str from X509Ref::ocsp_responders; AES key-wrap-with-padding buffer overflows in cipher_update and cipher_update_inplace). Fixed in 0.10.80. openssl is pinned to exactly 0.10.80 and openssl-sys to 0.9.116, the newest versions Bytecode Alliance's imported cargo-vet audits cover (0.10.78 -> 0.10.80, 0.9.114 -> 0.9.116); `cargo vet` refreshed imports.lock with those four audits and nothing else, so no unreviewed code enters. 0.10.82 would add ~1400 unaudited lines for no further fix. - RUSTSEC-2026-0462 (rmcp 1.5.0: unbounded body buffering in the Streamable HTTP clients). Fixed only in rmcp 3.9.0, two major versions away. rivet enables neither affected feature (transport-streamable-http-client-reqwest / -unix-socket); measured with `cargo tree -e features -i rmcp`. Ignored in deny.toml with the assessment, the reason not to upgrade now, a re-check trigger and a 2027-02-01 date, and in the audit step alongside it, as that step's comment requires. Confirmed locally: cargo deny check advisories bans licenses sources (0.20.2, CI's version) all ok; cargo audit --ignore RUSTSEC-2026-0462 exits 0 (7 allowed warnings, unchanged); cargo vet --locked succeeds; actionlint clean. On macOS native-tls uses Security.framework, so the openssl build itself is exercised only by Linux CI. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015HMQUV3u86jN2hmCtXNTc9
avrabe
enabled auto-merge
November 10, 2026 20:09
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Red-main fix. Cargo Deny, a CI Gate need, fails on main and on every PR (e.g. #1218) because of four advisories published against existing lockfiles.
X509Ref::ocsp_respondersnon-UTF-8&str)cipher_update)cipher_update_inplace)openssl is pinned to exactly 0.10.80 (openssl-sys 0.9.116), the newest versions that Bytecode Alliance's imported cargo-vet audits cover.
cargo vetadded exactly those four imported audits (0.10.78 → 0.10.80, 0.9.114 → 0.9.116) toimports.lock, so no unreviewed code enters. 0.10.82 would add about 1400 unaudited lines and no further fix.rmcp: the fix is rmcp 3.9.0, two major versions away, under rivet's MCP server. The advisory is confined to the
transport-streamable-http-client-reqwest/-unix-socketfeatures, and rivet enables neither. Themcpfeature takesserver,transport-io,macrosandtransport-streamable-http-server; the dev-dependency takesclientandtransport-child-process. I measured this withcargo tree -e features -i rmcp.deny.tomlrecords the assessment, why not to upgrade now, the re-check trigger (enabling any streamable-HTTP client feature), and a 2027-02-01 date. The real fix is the rmcp 3.x migration. The audit step gets the matching--ignore, as its comment requires.Note: the wohl session's report named crypto-bigint (RUSTSEC-2026-0387) and domain (RUSTSEC-2026-0310). Neither appears in rivet's cargo-deny output.
Local checks:
cargo deny check advisories bans licenses sources(0.20.2, CI's version): all ok.cargo audit --ignore RUSTSEC-2026-0462: exits 0, with the same 7 allowed warnings as before.cargo vet --locked: succeeds.On macOS, native-tls uses Security.framework, so only Linux CI builds openssl itself.
🤖 Generated with Claude Code
https://claude.ai/code/session_015HMQUV3u86jN2hmCtXNTc9