diff --git a/.cargo/audit.toml b/.cargo/audit.toml new file mode 100644 index 0000000..4111653 --- /dev/null +++ b/.cargo/audit.toml @@ -0,0 +1,7 @@ +[advisories] +ignore = [ + # ruzstd 0.8 decompression bomb. Reached only via subxt-lightclient -> smoldot, + # an optional subxt feature this crate never enables, so it is in Cargo.lock + # but never compiled. Every smoldot release pins ruzstd ^0.8. + "RUSTSEC-2026-0344", +] diff --git a/Cargo.lock b/Cargo.lock index 90fd9ec..7bb45e0 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1194,7 +1194,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -1762,7 +1762,7 @@ dependencies = [ "libc", "option-ext", "redox_users", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -1987,7 +1987,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -3859,6 +3859,18 @@ dependencies = [ "memoffset", ] +[[package]] +name = "nix" +version = "0.31.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d" +dependencies = [ + "bitflags 2.13.1", + "cfg-if 1.0.4", + "cfg_aliases", + "libc", +] + [[package]] name = "no_std_io2" version = "0.9.4" @@ -3972,7 +3984,7 @@ version = "0.50.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -5163,6 +5175,7 @@ dependencies = [ "rand_chacha 0.9.0", "reqwest 0.12.28", "rpassword", + "rustls", "rustls-webpki", "rxing", "scale-info", @@ -5217,9 +5230,9 @@ dependencies = [ [[package]] name = "quinn-proto" -version = "0.11.16" +version = "0.11.19" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560" +checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe" dependencies = [ "aws-lc-rs", "bytes", @@ -5250,7 +5263,7 @@ dependencies = [ "once_cell", "socket2", "tracing", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -5686,14 +5699,14 @@ dependencies = [ "errno", "libc", "linux-raw-sys 0.12.1", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "log", @@ -5766,7 +5779,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs 1.0.9", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -6133,11 +6146,10 @@ dependencies = [ [[package]] name = "self_update" -version = "1.0.0-rc.6" +version = "1.3.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b7cc0b87814417b0e0697ae582dfc5f614f469fbac9b138e40457d88913187d" +checksum = "9253f1675d280b3e348d63a03ad6af3fa32d515b0959406758342561655c4aa0" dependencies = [ - "either", "flate2", "http", "indicatif", @@ -7274,10 +7286,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.3", + "getrandom 0.3.4", "once_cell", "rustix 1.1.4", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -7771,7 +7783,7 @@ version = "1.6.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "97fee6b57c6a41524a810daee9286c02d7752c4253064d0b05472833a438f675" dependencies = [ - "cfg-if 1.0.4", + "cfg-if 0.1.10", "digest 0.10.7", "rand 0.8.6", "static_assertions", @@ -8258,7 +8270,7 @@ dependencies = [ "bitflags 1.3.2", "downcast-rs", "libc", - "nix", + "nix 0.24.3", "scoped-tls", "wayland-commons", "wayland-scanner", @@ -8271,7 +8283,7 @@ version = "0.29.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8691f134d584a33a6606d9d717b95c4fa20065605f798a3f350d78dced02a902" dependencies = [ - "nix", + "nix 0.24.3", "once_cell", "smallvec", "wayland-sys", @@ -8283,7 +8295,7 @@ version = "0.29.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6865c6b66f13d6257bef1cd40cbfe8ef2f150fb8ebbdb1e8e873455931377661" dependencies = [ - "nix", + "nix 0.24.3", "wayland-client", "xcursor", ] @@ -8403,7 +8415,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -8899,14 +8911,15 @@ dependencies = [ [[package]] name = "zip" -version = "8.6.0" +version = "9.0.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b" +checksum = "6e04976da629d3b04204ba8105b396a193af8ad2583b2c79bfb3ab8af580a11e" dependencies = [ "crc32fast", "flate2", "indexmap", "memchr", + "nix 0.31.3", "time", "typed-path", "zopfli", @@ -8914,9 +8927,9 @@ dependencies = [ [[package]] name = "zipsign-api" -version = "0.2.1" +version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "32a55ebb27e67d9a9d116dd3a19637ee8cc0570c8ef816fb504c453f15448c99" +checksum = "00d866e1d567fd67738668647c2e06587851e0e3583df84298cc363c14602316" dependencies = [ "base64", "ed25519-dalek", diff --git a/Cargo.toml b/Cargo.toml index bf93893..cd01aac 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -91,9 +91,9 @@ ed25519-dalek = "2" sha3 = "0.10" # Self-update: download and replace the running binary from GitHub releases. -# 1.0.0-rc.x is required for quick-xml >= 0.41 (RUSTSEC-2026-0194 / 0195); stable -# 0.44 still pins quick-xml ^0.38. Pulls reqwest 0.13 alongside our 0.12. -self_update = { version = "1.0.0-rc.6", default-features = false, features = [ +# 1.3 is required for zip >= 9 (RUSTSEC-2026-0367 / 0368 / 0369). Pulls reqwest 0.13 +# alongside our 0.12. +self_update = { version = "1.3.1", default-features = false, features = [ "archive-tar", "archive-zip", "compression-tar-gz", @@ -110,8 +110,11 @@ tempfile = "3" # Force patched version of bytes (RUSTSEC-2026-0007) bytes = "1.11.1" -# Force patched version of quinn-proto (RUSTSEC-2026-0037) -quinn-proto = "0.11.14" +# Force patched version of quinn-proto (RUSTSEC-2026-0037, RUSTSEC-2026-0338 .. 0342) +quinn-proto = "0.11.18" + +# Force patched version of rustls (RUSTSEC-2026-0346 .. 0349) +rustls = { version = "0.23.46", default-features = false } # Force patched version of rustls-webpki (RUSTSEC-2026-0098, RUSTSEC-2026-0099, RUSTSEC-2026-0104) rustls-webpki = "0.103.13"