From 8d8183226e18393728af219338428beba5cb705c Mon Sep 17 00:00:00 2001 From: Steve Gilvarry Date: Sun, 15 Nov 2026 13:35:05 +1100 Subject: [PATCH] chore(deps): keep the security audit passing on November's advisories cargo audit now fails on five advisories published since Oct 30. None of them touch the binary: actix-web, actix-http and libsqlite3-sys sit in Cargo.lock as optional dependencies no enabled feature builds. cargo-deny already skips them, since it only checks crates that get compiled. - Bump the locked actix-web (4.19.0) and actix-http (3.21.0), which clears four of the five. - libsqlite3-sys can't move (sqlx 0.9 caps it below the fix), so ignore RUSTSEC-2026-0459 in the cargo audit step and say why. - Bump rustix to 1.1.6 for RUSTSEC-2026-0486 (unsound). This one is compiled, through rustls-acme. - Drop four ignores from deny.toml (rsa, atomic-polyfill, rkyv 0.7, proc-macro-error2) and the two from the audit step: those crates are gone from the tree. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/test.yml | 13 ++++++++----- Cargo.lock | 14 +++++++------- deny.toml | 18 ------------------ 3 files changed, 15 insertions(+), 30 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 621461a2..0572304a 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -381,13 +381,16 @@ jobs: with: tool: cargo-audit,cargo-deny - # Ignored advisories are documented in deny.toml; cargo-audit does not - # read that file, so the ignore list is mirrored here. Keep the two in - # sync. RUSTSEC-2023-0071: unfixable rsa transitive dep via sqlx-mysql. - # RUSTSEC-2026-0235: rkyv 0.7.46 via webrtc/dtls (0.8.x is upgraded). + # cargo-audit reads every crate in Cargo.lock, including optional + # dependencies no enabled feature builds; cargo-deny (below) only checks + # what gets compiled. So this list holds advisories for crates that are + # locked but never built. + # RUSTSEC-2026-0459: libsqlite3-sys 0.30, locked through sqlx-sqlite. + # zm-api doesn't enable sqlx's sqlite feature, so it isn't compiled, and + # sqlx 0.9 caps it below the fixed 0.39. - name: Audit dependencies for known vulnerabilities run: >- - cargo audit --ignore RUSTSEC-2023-0071 --ignore RUSTSEC-2026-0235 + cargo audit --ignore RUSTSEC-2026-0459 - name: Check advisories, licenses and sources run: cargo deny check diff --git a/Cargo.lock b/Cargo.lock index f8739b78..f65d8c69 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -21,9 +21,9 @@ dependencies = [ [[package]] name = "actix-http" -version = "3.19.0" +version = "3.21.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b796ba3c974e5133f6ca1a2c4e97c5941ea1a46d202df83344afaa18219f1a62" +checksum = "3422032be73eeb15bafdb64086386385875b653eb418a80241d1f98473e86ea6" dependencies = [ "actix-codec", "actix-service", @@ -111,9 +111,9 @@ dependencies = [ [[package]] name = "actix-web" -version = "4.17.0" +version = "4.19.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "67756b0fc99e07b8702b9a856e3d6ec036387243c2ce6310070d1e8f02680bb0" +checksum = "acd6966acfcc7b66b37bdeea7d11665d5accac89333767e1784d2cecd33984e7" dependencies = [ "actix-codec", "actix-http", @@ -1029,7 +1029,7 @@ dependencies = [ "regex", "rustc-hash", "shlex", - "syn 3.0.9", + "syn 2.0.119", ] [[package]] @@ -5347,9 +5347,9 @@ dependencies = [ [[package]] name = "rustix" -version = "1.1.5" +version = "1.1.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d" +checksum = "e5e76742e5294153d4dde1207dbec5bdd81eef6fabdc0d2118babadabfd858aa" dependencies = [ "bitflags 2.13.2", "errno", diff --git a/deny.toml b/deny.toml index 790e7ba3..b6de226f 100644 --- a/deny.toml +++ b/deny.toml @@ -6,27 +6,9 @@ version = 2 # RUSTSEC advisory IDs to ignore, with a justification comment each. ignore = [ - # rsa "Marvin Attack" timing side-channel. No fixed `rsa` release exists and - # the crate is pulled in transitively (and unavoidably) by sqlx-mysql for the - # MariaDB/MySQL auth handshake — it is not used for any attacker-facing crypto - # in zm-api. Exploitation requires timing many RSA private-key operations; - # mitigated by a local/TLS database connection. Revisit when sqlx drops rsa. - "RUSTSEC-2023-0071", - # atomic-polyfill unmaintained. Deep transitive build-dep only - # (garde -> phonenumber -> postcard -> heapless), no safe upgrade available. - "RUSTSEC-2023-0089", - # rkyv 0.7.46 out-of-bounds read. The fix is rkyv >=0.8.17, but 0.7.46 is - # pulled transitively by the webrtc/dtls stack, which pins the 0.7 line; the - # directly-reachable rkyv (0.8.x) is already upgraded to 0.8.17. rkyv is not - # used to deserialize attacker-controlled archives in zm-api. Revisit when - # webrtc bumps rkyv to 0.8. - "RUSTSEC-2026-0235", # paste unmaintained. Build-time-only proc-macro helper, pulled transitively # (no runtime code); no maintained drop-in replacement across the tree. "RUSTSEC-2024-0436", - # proc-macro-error2 unmaintained. Build-time-only derive-macro dependency; - # unmaintained but not a vulnerability. Revisit if a maintained fork lands. - "RUSTSEC-2026-0173", ] [bans]