Repository navigation
chore(deps): bump toml from 1.2.0+spec-1.1.0 to 1.2.1+spec-1.1.0 in the rust-dependencies group - #2913
Closed
dependabot[bot] wants to merge 1 commit into
Closed
chore(deps): bump toml from 1.2.0+spec-1.1.0 to 1.2.1+spec-1.1.0 in the rust-dependencies group#2913dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the rust-dependencies group with 1 update: [toml](https://github.com/toml-rs/toml). Updates `toml` from 1.2.0+spec-1.1.0 to 1.2.1+spec-1.1.0 - [Commits](toml-rs/toml@toml-v1.2.0...toml-v1.2.1) --- updated-dependencies: - dependency-name: toml dependency-version: 1.2.1+spec-1.1.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Review summary (PR #2913)Verdict: No findings. Routine Dependabot patch bump — safe to merge pending CI. Change: Context read beyond the diff: Not reviewed: Full upstream No review submitted (no findings per workflow §5). |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
bashkit | 31397fe | Commit Preview URL Branch Preview URL |
Nov 10 2026, 09:41 PM |
chaliy
added a commit
that referenced
this pull request
Nov 11, 2026
The Audit job went red on every PR and on main without any change to the repository: RUSTSEC-2026-0486 was published against rustix on 2026-10-27, and `scripts/audit-lockfiles.sh` reads the advisory database live. This is exactly the case the scheduled advisory scan exists for. The advisory is an unsoundness in six xattr functions (`fgetxattr`, `flistxattr`, `getxattr`, `lgetxattr`, `listxattr`, `llistxattr`), which mark unwritten bytes as initialized when handed a zero-length buffer. It covers `>=1.0.0, <1.1.6`, and the scan runs `cargo audit --deny unsound`, so it fails rather than warns. Three lockfiles carried an affected version, and all three move to the patched 1.1.6: - `Cargo.lock` 1.1.4 - `crates/bashkit/fuzz/Cargo.lock` 1.1.5 - `examples/hyperlight/host/Cargo.lock` 1.1.4 rustix is transitive everywhere (tempfile, polling, memfd and four others), and bashkit calls none of the six functions, so this is a supply-chain hygiene bump rather than a reachable defect. A patched release exists, so nothing is suppressed and the threat model needs no new entry. Also folds in the `rust-dependencies` group bump from #2913, which was blocked on a stale `supply-chain/imports.lock`: toml 1.2.0 -> 1.2.1, serde_spanned 1.1.2 -> 1.1.3 and toml_datetime 1.1.2 -> 1.1.3. All three are already publisher-trusted to Ed Page (epage) through 2027-05-16, so refreshing the publisher records in imports.lock is all `cargo vet` needed - no new audit or exemption. rustix was already an exemption at 1.1.4 and stays one at 1.1.6: nobody reviewed the 1000-line upstream diff, and an audit entry would assert a source review that did not happen. Verified: `scripts/audit-lockfiles.sh` exits 0 with the rustix denial gone (remaining atomic-polyfill, ttf-parser and crypto-bigint warnings are the pre-existing allowed ones), `cargo vet --locked` succeeds (97 fully audited, 79 partially audited, 585 exempted), the workspace builds with http_client,ssh,sqlite,typescript, and the main test slice passes ~7,900 tests. The only local failure is `ssh_supabase_connects`, which dials the live public supabase.sh over port 22; this sandbox refuses outbound 22, and that test is a network gate that passes in CI.
2 tasks done
chaliy
added a commit
that referenced
this pull request
Nov 11, 2026
…nant (#2916) Two red CI signals, two independent causes, neither from a code change here. 1. rustix -> 1.1.6 for RUSTSEC-2026-0486, which fixes the Audit job that was red on every PR and on main. The advisory was published on 2026-10-27 against unchanged code and scripts/audit-lockfiles.sh reads the advisory database live, so the gate went red on its own. It is an unsoundness in six xattr functions (fgetxattr, flistxattr, getxattr, lgetxattr, listxattr, llistxattr), which mark unwritten bytes as initialized when handed a zero-length buffer, covering >=1.0.0 <1.1.6; the scan runs `cargo audit --deny unsound`, so it fails rather than warns. Three lockfiles carried an affected version and all three move to the patched 1.1.6: Cargo.lock (1.1.4), crates/bashkit/fuzz/Cargo.lock (1.1.5) and examples/hyperlight/host/Cargo.lock (1.1.4). rustix is transitive everywhere and bashkit calls none of the six functions, so this is supply-chain hygiene rather than a reachable defect. A patched release exists, so nothing is suppressed and the threat model needs no new entry. Resolving rustix 1.1.6 also moves several crates' windows-sys edge from 0.61.2 to 0.52.0 and one syn edge from 3.0.9 to 2.0.119. Both majors of each were already in the lockfiles, so nothing is added or removed; rustix declares a wide windows-sys range and cargo unifies onto the already-locked 0.52.0. This is inherent to the bump, not an artifact of `cargo update --precise`: a plain `cargo update -p rustix` produces the identical edges. The flip only affects Windows, and all five Windows jobs pass. Also folds in the rust-dependencies group bump from #2913, which was blocked on a stale supply-chain/imports.lock rather than on a missing audit: toml 1.2.0 -> 1.2.1, serde_spanned 1.1.2 -> 1.1.3, toml_datetime 1.1.2 -> 1.1.3. All three are already publisher-trusted to Ed Page (epage) through 2027-05-16, so refreshing the publisher records was all cargo vet needed. rustix was already an exemption at 1.1.4 and stays one at 1.1.6: nobody reviewed the 1000-line upstream diff, and an audit entry would assert a source review that did not happen. #2913 is superseded. 2. The ts spin tenant no longer races two resource limits, which fixes the nightly ts-stress-soak job. Test-only; no product change. ts_mixed_hostile_and_good_tenants_stay_isolated asserted that its spin tenant (while (true) {}, 300 ms max_duration) exits 124. But ZapCode charges one allocation per VM stack push and never decrements the counter (zapcode_vendor/sandbox.rs, track_allocation), so max_allocations is a per-run budget of operations, not a live heap bound - that is max_memory. The loop spends about one push per iteration, so release burns the 1,000,000 default in a few milliseconds and exits 1 with "allocation limit exceeded", while debug reaches the clock first and exits 124. PR CI runs debug and the soak runs release, so the assertion could only ever hold in debug. Both outcomes are correct bounded termination, so the spin tenant now asserts only that it stopped on one of its own limits, and each limit is pinned on its own and deterministically in either profile: ts_runaway_loop_stops_on_the_wall_clock raises the allocation budget past what a 300 ms loop can spend, so the clock binds and exit 124 is exact (the case the soak was meant to cover, TM-TS-027); and ts_runaway_loop_stops_on_the_allocation_budget lowers it to 50,000 against a 60 s limit, so the push budget binds and exit 1 is exact. Knowledge records that max_allocations bounds operations rather than heap, and why the spin assertion is deliberately loose. Verified: audit-lockfiles.sh exits 0 with the rustix denial gone, cargo vet --locked succeeds, and the soak is green in release at the nightly's 300 rounds (112.91s) and in debug (2.09s). 51 checks green.
Contributor
|
Superseded by #2916 (merged as 4c3f625), which carries this exact group bump — toml 1.2.0 → 1.2.1, serde_spanned 1.1.2 → 1.1.3, toml_datetime 1.1.2 → 1.1.3 — with the same resolved versions. For the record, since the #2916 also had to bump rustix to 1.1.6 for Generated by Claude Code |
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/cargo/rust-dependencies-aa68e2db90
branch
November 11, 2026 10:34
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the rust-dependencies group with 1 update: toml.
Updates
tomlfrom 1.2.0+spec-1.1.0 to 1.2.1+spec-1.1.0Commits
563cb1achore: Release4ad20a6docs: Update changelogf09854aperf(serde): Report size hints (#1262)663302bperf(serde): Report size hints22ef745chore: ReleaseDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsOpen in [code]smith · Need help on this PR? Tag
@codesmith-botwith what you need.