From abedf6012867118aca41f5155f3b0a0498989071 Mon Sep 17 00:00:00 2001 From: Eliah Kagan Date: Thu, 29 Oct 2026 16:30:12 -0400 Subject: [PATCH] Report transitive soundness advisories and update affected dependencies Investigating advisory coverage across GitoxideLabs exposed that `cargo-deny` now defaults to checking soundness advisories only for direct workspace dependencies. Gitoxide inherited that narrower default through an action update, losing coverage it previously had. Set `unsound = "all"` explicitly so transitive soundness findings are reported too. These findings can be security-relevant even when no concrete exploit has been established. Update the locked `event-listener`, `lru`, and `tokio` versions to address `RUSTSEC-2026-0221`, `RUSTSEC-2026-0253`, and `RUSTSEC-2026-0386`, respectively. Keep the dependency updates with the policy change so this commit passes the expanded advisory check independently. Co-authored-by: Codex --- Cargo.lock | 17 ++++++++--------- deny.toml | 2 ++ 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 60b6ed9ebff..45e98c03745 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -225,7 +225,7 @@ version = "3.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "290f7f2596bd5b78a9fec8088ccd89180d7f9f55b94b0576823bbbdc72ee8311" dependencies = [ - "event-listener 5.4.1", + "event-listener 5.4.2", "event-listener-strategy", "pin-project-lite", ] @@ -1159,11 +1159,10 @@ checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0" [[package]] name = "event-listener" -version = "5.4.1" +version = "5.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab" +checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2" dependencies = [ - "concurrent-queue", "parking", "pin-project-lite", ] @@ -1174,7 +1173,7 @@ version = "0.5.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93" dependencies = [ - "event-listener 5.4.1", + "event-listener 5.4.2", "pin-project-lite", ] @@ -3673,9 +3672,9 @@ dependencies = [ [[package]] name = "lru" -version = "0.18.0" +version = "0.18.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8a860605968fce16869fd239cf4237a82f3ac470723415db603b0e8b6c8d4fb9" +checksum = "5d2f2f9b4ba7e6b24d95e7e899329d35be83bcded72c8540cdd5368932d1d90a" dependencies = [ "hashbrown 0.17.1", ] @@ -5431,9 +5430,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" [[package]] name = "tokio" -version = "1.52.3" +version = "1.53.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe" +checksum = "ce3335fa71841cda333a58d7615b03901380ecf09d59b3296d21f8bbac0dde4e" dependencies = [ "bytes", "libc", diff --git a/deny.toml b/deny.toml index 969a96dd06c..776c4411722 100644 --- a/deny.toml +++ b/deny.toml @@ -8,6 +8,8 @@ # More documentation for the advisories section can be found here: # https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html [advisories] +# Report soundness advisories for transitive dependencies too. +unsound = "all" ignore = [ { id = "RUSTSEC-2025-0052", reason = "`async-std` - unmaintained without replacement - needs some time to replace, but async version isn't too important right now" }, ]