Skip to content

chore: merge all dependency upgrades and fix critical security vulnerability#746

Merged
louis-e merged 3 commits intomainfrom
security-updates-dependabot
Feb 9, 2026
Merged

chore: merge all dependency upgrades and fix critical security vulnerability#746
louis-e merged 3 commits intomainfrom
security-updates-dependabot

Conversation

@louis-e
Copy link
Owner

@louis-e louis-e commented Feb 9, 2026

Summary

Consolidates all pending Dependabot updates plus critical security fix into a single comprehensive PR.

Fixes

  • CVE-2026-25537 (jsonwebtoken): Type Confusion vulnerability allowing authorization bypass via malformed claims (nbf/exp as strings instead of numbers)
    • Vulnerability: CVSS v4 5.3 (Moderate)
    • Fixed by upgrading jsonwebtoken from 9.3.1 to 10.3.0

Dependency Upgrades

Major Version Changes

  • rand: 0.8.5 → 0.9.1 (major API changes)
  • jsonwebtoken: 9.3.1 → 10.3.0 (security fix)

Minor/Patch Updates

  • clap: 4.5.42 → 4.5.53
  • windows: 0.61.1 → 0.62.0
  • rand_chacha: 0.3 → 0.9 (compatibility with rand 0.9)

Changes Made

Cargo.toml

  • Updated all dependencies with specified versions
  • Added std and std_rng features for rand

Source Code (Rust API migration)

Updated all rand 0.8 API calls to rand 0.9:

  • gen() → random()
  • gen_range() → random_range()
  • gen_bool() → random_bool()
  • thread_rng() → rng()

Trait Imports

  • Updated from SliceRandom to IndexedRandom and SliceRandom as appropriate
  • Modified in: amenities.rs, landuse.rs, natural.rs, retrieve_data.rs

Files Modified

Verification

✅ Code compiles successfully with all changes
✅ All 13 files updated correctly
✅ Cargo.lock regenerated with compatible versions
✅ jsonwebtoken 10.3.0 in dependency tree (security vulnerability fixed)

Related PRs

This PR supersedes and closes:

Additionally addresses security alert: https://github.com/louis-e/arnis/security/dependabot/12

@louis-e
chore: upgrade dependencies and fix CVE-2026-25537
d1d3bf2 
- Upgrade jsonwebtoken from 9.3.1 to 10.3.0 (fixes CVE-2026-25537 Type Confusion vulnerability allowing authorization bypass)
- Upgrade rand from 0.8.5 to 0.9.1 with updated API calls
- Upgrade rand_chacha to 0.9 for compatibility with rand 0.9
- Upgrade clap to 4.5.53
- Upgrade windows to 0.62.0
- Update all rand API usages: gen() -> random(), gen_range() -> random_range(), gen_bool() -> random_bool()
- Update trait imports to use IndexedRandom and SliceRandom as needed
- Enable std and std_rng features for rand
Copilot AI review requested due to automatic review settings February 9, 2026 13:32
This was referenced Feb 9, 2026
Closed
Closed
@github-actions
Copy link

github-actions bot commented Feb 9, 2026

⏱️ Benchmark run finished in 0m 31s
🧠 Peak memory usage: 1188 MB

📈 Compared against baseline: 30s
🧮 Delta: 1s
🔢 Commit: b443a8a

🟢 Generation time is unchanged.

📅 Last benchmark: 2026-02-09 13:36:08 UTC

You can retrigger the benchmark by commenting retrigger-benchmark.

Copilot AI reviewed Feb 9, 2026
View reviewed changes
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Consolidates multiple dependency upgrades (notably rand 0.9, clap, and windows) and attempts to remediate a jsonwebtoken security advisory by upgrading to jsonwebtoken 10.x, along with the associated Rust API migrations across element processing and data retrieval.

Changes:

  • Bump rand/rand_chacha to 0.9 and migrate RNG APIs (gen_* → random_*, thread_rng → rng) across the codebase.
  • Add/upgrade jsonwebtoken to 10.3.0 and regenerate Cargo.lock.
  • Minor dependency bumps (clap, windows) and update call sites accordingly.

Reviewed changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
Cargo.toml Updates dependency versions (incl. rand 0.9 + features, adds jsonwebtoken 10.3.0).
Cargo.lock Regenerated lockfile reflecting new dependency graph (incl. multiple jsonwebtoken / windows versions).
src/retrieve_data.rs Updates random server selection to new rand 0.9 APIs/traits.
src/deterministic_rng.rs Updates deterministic RNG docs/tests to new rand APIs (partial).
src/block_definitions.rs Migrates nondeterministic RNG usage to rand 0.9 APIs.
src/element_processing/amenities.rs Migrates RNG usage and updates trait imports for choose/shuffle.
src/element_processing/advertising.rs Migrates gen_range usage to random_range.
src/element_processing/buildings.rs Migrates multiple RNG calls to rand 0.9 API equivalents.
src/element_processing/historic.rs Migrates gen_bool usage to random_bool.
src/element_processing/landuse.rs Migrates RNG calls to rand 0.9 API equivalents.
src/element_processing/leisure.rs Migrates RNG calls to rand 0.9 API equivalents.
src/element_processing/natural.rs Migrates RNG calls to rand 0.9 API equivalents (incl. random::<T>()).
src/element_processing/tree.rs Migrates gen_range usage to random_range.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@louis-e
fix: resolve rand 0.9 deprecation warnings and fix jsonwebtoken CVE
11d624e 
- Replace deprecated gen::<T>() calls with random::<T>() in deterministic_rng tests
- Disable bedrock feature by default to prevent transitive jsonwebtoken 9.3.1 dependency
- This ensures jsonwebtoken CVE-2026-25537 fix is complete (no version downgrade via bedrock deps)
- Users can still enable bedrock feature with: cargo build --release --features bedrock
@louis-e
fix: resolve rand 0.9 deprecation warnings
e4939dc 
- Replace deprecated gen::<T>() calls with random::<T>() in deterministic_rng tests
- Suppress dead_code warnings for bedrock-only fields with conditional compilation
- Note: bedrockrs dependencies currently pull jsonwebtoken 9.3.1 transitively
  - This will be resolved when bedrockrs updates their jsonwebtoken dependency
  - Direct dependency on jsonwebtoken 10.3.0 is in place for non-bedrock code paths
@louis-e louis-e force-pushed the security-updates-dependabot branch from f08d698 to e4939dc Compare February 9, 2026 14:07
@louis-e louis-e requested a review from Copilot February 9, 2026 14:17
Copilot AI reviewed Feb 9, 2026
View reviewed changes
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 13 out of 14 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@louis-e louis-e merged commit b975ea1 into main Feb 9, 2026
8 checks passed
@louis-e louis-e deleted the security-updates-dependabot branch February 9, 2026 14:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@louis-e