8000 fix(deps): pin bitmaps 3.1.0 to clear RUSTSEC-2025-0167 (unsound) by norrietaylor · Pull Request #1588 · gominimal/minimal · GitHub
[go: up one dir, main page]
Skip to content

fix(deps): pin bitmaps 3.1.0 to clear RUSTSEC-2025-0167 (unsound) - #1588

Merged
norrietaylor merged 2 commits into
mainfrom
fix/deps-bitmaps-rustsec-2025-0167
Sep 24, 2026
Merged

fix(deps): pin bitmaps 3.1.0 to clear RUSTSEC-2025-0167 (unsound)#1588
norrietaylor merged 2 commits into
mainfrom
fix/deps-bitmaps-rustsec-2025-0167

Conversation

@norrietaylor
@norrietaylor norrietaylor commented Sep 23, 2026 •
edited by coderabbitai Bot
Loading
Copy link
Copy Markdown
Member

Summary

Clears RUSTSEC-2025-0167 (bitmaps unsound: Bitmap's TryFrom<&[u8]> / AsMut<[u8]> can create invalid values) by pinning bitmaps to 3.1.0 in Cargo.lock. It no longer needs an advisory ignore.

  • Pin: cargo update -p bitmaps --precise 3.1.0 changes only the bitmaps entry in Cargo.lock (3.2.1 -> 3.1.0). The advisory lists patched = [] and unaffected = ["< 3.2.0"], so 3.1.0 is outside the affected range. The two unsound impls (AsMut<[u8]> and TryFrom<&[u8]> in src/bitmap.rs) exist in 3.2.1 and not in 3.1.0. imbl-sized-chunks 0.1.3 requires bitmaps ^3.1.0, so the pin is compatible.
  • Guard: a [bans].deny entry { crate = "bitmaps:>=3.2.0", ... } makes cargo deny check bans fail if a later cargo update brings 3.2.x back. The comment says to remove it together with the RUSTSEC-2026-0292 ignore once nickel moves to imbl-sized-chunks 0.2, which drops bitmaps. Note that cargo-deny's name@ver form matches an exact version only. bitmaps@>=3.2.0 is accepted without error but matches nothing, so the guard uses the name:req form.

Why not upgrade nickel instead: imbl-sized-chunks 0.2.0 drops bitmaps, but nickel-lang-vector requires imbl-sized-chunks = "0.1" both at our pinned nickel rev (21decd29) and on nickel master.

Context on reachability (supporting only): even on 3.2.1, minimal did not appear to reach the unsound code:

  • bitmaps comes in only via nickel-lang-core -> nickel-lang-vector -> imbl-sized-chunks 0.1.3.
  • imbl-sized-chunks uses Bitmap only as SparseChunk's private index map and never calls either unsound API.
  • nickel-lang-vector uses only Chunk, never SparseChunk.

Resolves the dep-drift finding tracked in https://github.com/gominimal/inbox/issues/496

Testing

cargo 1.98.1, cargo-deny 0.20.2:

  • cargo check --workspace: finished with exit 0.
  • cargo deny check: advisories ok, bans ok, licenses ok, sources ok. The remaining advisory-not-detected warning is the existing RUSTSEC-2026-0009 entry.
  • With unsound = "all" temporarily added to [advisories], using this branch's deny.toml (no RUSTSEC-2025-0167 ignore) and the 3.1.0 lock: advisories ok. For comparison, main (3.2.1, no ignore) gave error[unsound] RUSTSEC-2025-0167 -> advisories FAILED.
  • Guard check: temporarily ran cargo update -p bitmaps --precise 3.2.1, then cargo deny check bans: 
    error[banned]: crate 'bitmaps = 3.2.1' is expli
8000
citly banned
...
bans FAILED
    Then restored the 3.1.0 lockfile.

Checklist

  • Docs updated if behavior changed (n/a)
  • BREAKING CHANGE: footer present if this is a breaking change (n/a)

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Security
    • Added a safeguard against using versions associated with a known security advisory. The version currently in use is unaffected, so this change does not alter existing app behavior. Further updates to the safeguard are planned alongside a future compatibility change.

@norrietaylor @claude
chore(deny): accept RUSTSEC-2025-0167 (bitmaps unsound) until nickel …
6c9c6de 
…pins imbl-sized-chunks 0.2

bitmaps has no patched release and upstream is archived. It is reached
only via nickel-lang-core -> nickel-lang-vector -> imbl-sized-chunks 0.1,
which uses Bitmap solely as SparseChunk's private index map and never
calls the unsound TryFrom<&[u8]> / AsMut<[u8]> impls; nickel-lang-vector
uses only Chunk. imbl-sized-chunks 0.2.0 drops bitmaps, but nickel (the
pinned rev and master) still requires "0.1".

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Copilot AI lite review requested due to automatic review settings September 23, 2026 23:10
@norrietaylor
norrietaylor requested a review from a team as a code owner September 23, 2026 23:10
@coderabbitai
coderabbitai Bot commented Sep 23, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

Review in Change Stack →

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 7d950897-6b87-4e45-943c-f8a105fb4982

📥 Commits

Reviewing files that changed from the base of the PR and between 85c9b4a and 475d7e8.

⛔ Files ignored due to path filters (1)
  • Cargo.lock is excluded by !**/*.lock
📒 Files selected for processing (1)
  • deny.toml

Included review availability: Your plan provides up to 5 included reviews per hour; 1 remains after this review.

📝 Walkthrough

Walkthrough

The deny configuration now rejects bitmaps versions >=3.2.0 and cites RUSTSEC-2025-0167. Comments note the lockfile’s earlier pinned version and the planned condition for removing the ban and advisory ignore.

Changes

Dependency version ban

Layer / File(s) Summary
Add the bitmaps version rule
deny.toml		 The bans.deny rule rejects bitmaps versions >=3.2.0 and cites RUSTSEC-2025-0167. Comments connect removal of the rule and RUSTSEC-2026-0292 ignore to Nickel moving to imbl-sized-chunks 0.2.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: evanspearman

Merge Risk: ⚪ Minimal · up to 475d7

The dependency is pinned outside the advisory range, and the version ban blocks affected upgrades; no actionable merge risk remains.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely describes the primary dependency change and follows the required Conventional Commit format.
Description check ✅ Passed The description includes complete Summary, Testing, and Checklist sections. It explains the dependency pin, the cargo-deny guard, compatibility, rationale, issue reference, and test results.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR

A rabbit checks the crate list twice,
And hops past versions not so nice.
The lockfile holds an older friend,
While comments mark the future end.
One tidy rule guards what may grow,
Then off through clover fields we go.

Comment @coderabbitai help to get the list of available commands.

Copilot AI reviewed Sep 23, 2026
View reviewed changes
Copilot AI left a comment
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

No unresolved review comments remain.

Review effort: Lite
Findings: None

What changed in this PR

Accepts the known unsound bitmaps advisory until Nickel upgrades its dependency.

Changes:

  • Adds RUSTSEC-2025-0167 to deny.toml.
  • Documents reachability, rationale, and removal conditions.
File Description
deny.toml Records the accepted transitive advisory risk and dependency upgrade rationale.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@minimal-foundry
minimal-foundry Bot commented Sep 23, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

Reviewed: 1 finding, none blocking at 475d7e8132e6.

Address the comments on the diff.

Clobber: none: git log on both files shows no recent fix reverted.

@norrietaylor @claude
fix(deps): pin bitmaps 3.1.0 to clear RUSTSEC-2025-0167 (unsound)
475d7e8 
RUSTSEC-2025-0167 affects bitmaps >= 3.2.0 (unaffected: < 3.2.0); the
unsound TryFrom<&[u8]> / AsMut<[u8]> impls on Bitmap do not exist in
3.1.0. imbl-sized-chunks 0.1.3 requires bitmaps ^3.1.0, so downgrading
the lockfile entry is a lockfile-only change.

Replace the accept-risk ignore with the pin, and add a [bans] deny for
bitmaps >=3.2.0 so a later `cargo update` can't silently bring 3.2.x
back. Remove both with the RUSTSEC-2026-0292 ignore once nickel moves to
imbl-sized-chunks 0.2, which drops bitmaps.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@norrietaylor norrietaylor changed the title chore(deny): accept RUSTSEC-2025-0167 (bitmaps unsound) until nickel pins imbl-sized-chunks 0.2 fix(deps): pin bitmaps 3.1.0 to clear RUSTSEC-2025-0167 (unsound) Sep 23, 2026
minimal-foundry[bot]
minimal-foundry Bot approved these changes Sep 23, 2026
View reviewed changes
@minimal-foundry minimal-foundry Bot left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

minimal-review — approved

Verdict APPROVE — No findings.

@minimal-foundry minimal-foundry Bot added the review:approved minimal-review approved the current head label Sep 23, 2026
minimal-foundry[bot]
minimal-foundry Bot reviewed Sep 23, 2026
View reviewed changes
@minimal-foundry minimal-foundry Bot left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

minimal-review — advisory review

Verdict COMMENT — 1 finding, 1 inline.

Comment thread deny.toml Resolved
@minimal-foundry minimal-foundry Bot removed the review:approved minimal-review approved the current head label Sep 23, 2026
@norrietaylor
norrietaylor merged commit bab81cf into main Sep 24, 2026
33 checks passed
@norrietaylor
norrietaylor deleted the fix/deps-bitmaps-rustsec-2025-0167 branch September 24, 2026 23:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@minimal-foundry minimal-foundry[bot] minimal-foundry[bot] approved these changes
@coderabbitai coderabbitai[bot] coderabbitai[bot] approved these changes
@bryan-minimal bryan-minimal bryan-minimal approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@norrietaylor @bryan-minimal
0