Repository navigation
fix(deps): hotfix 0.7.2 with the RUSTSEC bumps (zstd, ctutils, crypto-bigint, tokio) - #2630
Merged
Merged
Conversation
…C-2026-0391, -0398 and -0403 (#2627) Claude-Session: https://claude.ai/code/session_01NSAwDroXL6KqsSxUzdbZGw Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 468a859)
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the
 |
* build(deps): ctutils 0.4.5, for RUSTSEC-2026-0385 A new advisory on ctutils 0.4.2 (non-constant-time mask generation and u128 comparisons; a transitive dependency through p256, ecdsa, elliptic-curve and crypto-bigint) fails cargo-deny on every pull request since this morning, so nothing can merge until the lock moves. Patched in 0.4.4; the lock takes 0.4.5. cargo deny check advisories is clean again and the workspace checks --locked. * chore(ci): re-run the cla status (cherry picked from commit c9114e1)
(cherry picked from commit 20e25e4)
Contributor
|
Approved: no findings at Nothing to do. Clobber: none seen. |
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NSAwDroXL6KqsSxUzdbZGw
bryan-minimal
approved these changes
Oct 26, 2026
tokio 1.53.3 deprecates AsyncFd::new as unsound (tokio-rs/tokio#8587), and clippy's -D warnings fails the build on it. Port main's fix from #2326 to both call sites, the PTY master and the tap device. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NSAwDroXL6KqsSxUzdbZGw
norrietaylor
approved these changes
Oct 26, 2026
Hotfix release carrying the zstd, ctutils, crypto-bigint and tokio bumps (RUSTSEC-2026-0385, -0386, -0387, -0391, -0398, -0403) onto 0.7.1. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NSAwDroXL6KqsSxUzdbZGw
2 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-picks of #2627, #2503 and #2517 to release/0.7.0, plus tokio 1.53.1 → 1.53.3 for RUSTSEC-2026-0386 (main got it in the #2326 group bump). That tokio deprecates
AsyncFd::new, so this also carries #2326's two-site switch toAsyncFd::register. Bumps the version to 0.7.2, as #2471 did for 0.7.1.🤖 Generated with Claude Code
https://claude.ai/code/session_01NSAwDroXL6KqsSxUzdbZGw