Repository navigation
chore(deps): bump rustls and source-map-js in lockfiles to clear Dependabot alerts - #161
Merged
Merged
Conversation
…ndabot alerts Cargo.lock: rustls 0.23.43 -> 0.23.45 (and rustls-webpki 0.103.13 -> 0.103.15). The entry is not built (cargo tree -i rustls --target all is empty) but stays in the lockfile through reqwest 0.13's optional hyper-rustls, so it is bumped rather than removed. web/package-lock.json: source-map-js 1.2.1 -> 1.2.2.
Owner
Author
|
TL ACCEPT at Lock-only: rustls 0.23.45 + rustls-webpki 0.103.15 (cannot drop rustls; optional hyper-rustls keeps the entry), source-map-js 1.2.2 single-entry bump. Merge after #160 (done) + QA GO (CI + |
Owner
Author
|
TL ACCEPT reaffirmed at |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lockfile-only change to clear the two open Dependabot alerts. No manifest or code changes.
Changes
Cargo.lock:rustls0.23.43 -> 0.23.45 (alert: TLS 1.3 handshake messages accepted across encryption level boundaries, fixed in 0.23.45), plusrustls-webpki0.103.13 -> 0.103.15 pulled bycargo update -p rustls --precise 0.23.45.cargo tree -i rustls --target allprints nothing (TLS is native-tls since chore(deps)(deps): bump reqwest from 0.12.28 to 0.13.4 #134). The entry stays in the lockfile through reqwest 0.13's optionalhyper-rustls, so removing it by hand would be re-added by Cargo. Bumping it is the stable fix.web/package-lock.json:source-map-js1.2.1 -> 1.2.2 (alert: event-loop DoS via indexed source-map section offsets). Edited the single entry (version, resolved, integrity fromnpm view source-map-js@1.2.2) to avoid unrelated churn from a different npm version.Verification
cargo clippy --locked --all-targets -- -D warningsclean,cargo test --locked: 921 passed.web/:npm ciinstalls source-map-js 1.2.2, 0 vulnerabilities;npm run verify(typecheck, build, 39 tests) passes on Node 22.