Repository navigation
chore(deps): bump hickory-proto to 0.26.2 for RUSTSEC-2026-0487..0491 - #9351
Merged
Merged
Conversation
hickory-proto 0.26.1 (via iroh) has five new advisories, which fail the cargo-deny advisories check on main. 0.26.2 carries the fixes. Bump it in both lockfiles: the root workspace (buzz-relay-mesh) and desktop/src-tauri (the mesh-llm feature used by release builds). Lockfile-only change. Co-authored-by: Larry <627498bd4bd1f281a16431e3c6cce3b5c25b6692798c78672298aefbf2f8f8b5@buzz.block.builderlab.xyz> Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Logan Johnson <[email protected]>
loganj
marked this pull request as ready for review
November 11, 2026 17:26
github-actions
Bot
added
the
codex-security-review-current
🔐 Codex Security Review
Review SummaryOverall Risk: NONE
FindingsNo concrete security, correctness, or reliability findings were identified. Notes
Generated by Codex Security Review | |
wpfleger96
approved these changes
Nov 11, 2026
philazar
added a commit
that referenced
this pull request
Nov 11, 2026
Co-Authored-By: Claude Opus 5.5 <[email protected]> * origin/main: (22 commits) chore(deps): bump hickory-proto to 0.26.2 for RUSTSEC-2026-0487..0491 (#9351) feat(mobile/ios): show the message's own text in notifications (#9346) feat(mobile): prefill the agents you last tagged in a conversation (#9248) feat(mobile): start a Solo chat from a message or inbox row (#9251) feat(mobile): link to Builderlab web from Settings (#9300) fix(relay): bound invite preview host lookup (#9308) fix(relay): saturate filter limits instead of casting (#9230) fix(mobile): tell same-name agents apart in Solo (#9321) fix(mobile): join an open channel from the chat footer (#9253) fix(relay): fence pending subscriptions on close or replacement (#2382) fix(mobile): hide archived people and agents from choices; give them their own members section (#9320) Add video stacks and native iOS zoom playback (#9316) Support PNG and HEIC photos in the native iOS zoom gallery (#9314) fix(mobile): list known people in recipient pickers before a name is typed (#9311) feat(mobile): mark edited messages after the body (#8863) Add swipeable photo stacks and native iOS gallery preview (#9259) ci(docker): skip relay image publishes for main pushes outside the build context (#9310) Add manual-only relay image publishing (#9303) fix(mobile): bump Flutter to 3.47.9 for Android TLS fix (#9309) Serve video and poster previews for invite links (#9306) ... Signed-off-by: Philip Azar <[email protected]>
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mainfails becausehickory-proto0.26.1 now has five published security advisories: RUSTSEC-2026-0487, -0488, -0489, -0490 and -0491 (panics and memory amplification when parsing malformed DNS records or zone text).hickory-prototo 0.26.2, which carries all five fixes. With it,cargo-deny checkpasses again (advisories, bans, licenses and sources all ok).desktop/src-tauri) gets the same update. CI does not run cargo-deny there, but release builds includehickory-protothrough themesh-llmfeature, so they would otherwise still ship 0.26.1.Details
hickory-protois a transitive dependency:iroh→hickory-resolver→hickory-net→hickory-proto. No crate names it directly.hickory-netandhickory-resolverstay at 0.26.1; they accepthickory-proto ^0.26.0and get the fixes through it.hickory-protoversion and checksum in each lockfile. 0.26.2 has the same dependency list as 0.26.1, and the locked versions already meet its raised minimums. A plaincargo update -p hickory-protoalso moved ten unrelated Windows-only crates fromwindows-sys0.59 to 0.61; those are left out to keep this change to the advisory fix.🤖 Generated with Claude Code