chore(deps): bump vulnerable/yanked lockfile deps to clear global CI failures#6280
Conversation
houko
left a comment
houko
left a comment
There was a problem hiding this comment.
Lock-only change; cargo-deny (advisories) is now green. One undocumented diff item to confirm — see inline note on the getrandom line.
Generated by Claude Code
| dependencies = [ | ||
| "fastrand", | ||
| "getrandom 0.4.2", | ||
| "getrandom 0.3.4", |
There was a problem hiding this comment.
The PR description says the cascade is limited to three version+checksum pairs (crypto-bigint, hybrid-array, typenum), but the diff contains a 4th undocumented change here: one package's resolved getrandom dependency shifted from 0.4.2 (0.4.x line) to 0.3.4 (0.3.x line).
getrandom is a security-sensitive RNG crate, so any version change to it — even a transitive one — is worth calling out explicitly in the PR body.
This is almost certainly a benign resolver cascade (both getrandom 0.3.x and 0.4.x likely still coexist in the lock file; one package just picked a different already-present version), but it's worth confirming that the package at this location doesn't rely on any getrandom 0.4-specific API that would silently fall back to the older implementation.
Generated by Claude Code
…failures Two independent upstream events on 2026-06-22 wedged CI on every branch (main's next run and all open PRs), neither caused by any PR's content: 1. crypto-bigint 0.7.0 through 0.7.4 were all yanked from crates.io. The lock pinned the yanked 0.7.3, failing cargo-deny's `yanked = "deny"` advisory check. 2. RUSTSEC-2026-0185 (high, 7.5) was published against quinn-proto < 0.11.15 — remote memory exhaustion from unbounded out-of-order stream reassembly — failing the `cargo xtask deps --audit` Security check. Lock-only bumps to the fixed releases plus the minimal compatible cascade each requires: - crypto-bigint 0.7.3 -> 0.7.5 (pulls hybrid-array 0.4.10 -> 0.4.12, typenum 1.19.0 -> 1.20.1) - quinn-proto 0.11.14 -> 0.11.15 No source, manifest, or feature changes.
258ca1e to
7fd417d
Compare
houko
changed the title
1 participant
Problem
CI is red on every branch since ~23:00 UTC 2026-06-22 — this PR, the open dependabot PRs (cron #6278, wasmtime, cargo-minor-patch), and main's next scheduled run. It was green on main at the beta.22 push (10:57). Two independent upstream events, neither caused by any PR's content, wedged two separate required checks:
1.
cargo-deny (advisories)— yanked cratecrypto-bigint0.7.0 through 0.7.4 were all yanked from crates.io. The lock pinned the yanked 0.7.3, anddeny.tomlsetsyanked = "deny":2.
Security(cargo xtask deps --audit) — new high-severity advisoryRUSTSEC-2026-0185 (published 2026-06-22, 7.5 high) against quinn-proto < 0.11.15 — "Remote memory exhaustion from unbounded out-of-order stream reassembly". The lock pinned the vulnerable 0.11.14:
Fix
Lock-only bumps to the fixed releases, plus the minimal compatible cascade each requires (all resolver-chosen, within existing semver ranges):
crypto-bigint0.7.3 → 0.7.5 — pullshybrid-array0.4.10 → 0.4.12 andtypenum1.19.0 → 1.20.1quinn-proto0.11.14 → 0.11.15No source, manifest, or feature changes. Merging this unblocks both
cargo-denyandSecurityacross all open branches once they rebase.Verification
git diff origin/main --stat: onlyCargo.lock, 8 lines each side (the four crate version+checksum pairs above).