build(deps): bump the cargo-patch group across 1 directory with 3 updates - #140
Merged
Merged
Conversation
dependabot
Bot
added
dependencies
3 tasks
kwhorne
added a commit
that referenced
this pull request
Sep 26, 2026
Fixes **RUSTSEC-2026-0285** in rustls: the TLS 1.3 handshake accepted handshake messages across encryption-level boundaries (affected `>=0.23.13, <0.23.45`). ## Exposure ElyraSQL shipped rustls **0.23.41** in every release from 0.9.9 through 1.11.3, on paths the server exposes: - `tokio-rustls` in `elyra-server` / `elyra-wire`: the TLS listener for client connections. - `ureq` in `elyra-engine`: outbound embedding calls. The advisory was published **2026-09-14**, two days after 1.11.3, so that release's audit was green. Dependabot #140 was the first CI run afterwards and surfaced it; #140 itself doesn't touch rustls and will go green once this lands and it is rebased. ## Change `cargo update -p rustls` in both lockfiles. Semver-compatible, no `Cargo.toml` or code change. | crate | before | after | |---|---|---| | rustls (root) | 0.23.41 | 0.23.45 | | rustls (testbench) | 0.23.43 | 0.23.45 | | rustls-webpki | 0.103.13 | 0.103.15 | ## Verified - [x] `cargo audit` on the root lockfile: 0 vulnerabilities (only the two documented `yanked` warnings remain). - [x] Full workspace suite green (durability excluded); clippy/fmt clean. - [x] **TLS smoke test by hand.** No automated test covers the handshake (the harness runs with TLS off), so a release build was tested from a MySQL 8.4 client: TLS 1.3 forced with the certificate verified (`TLS_AES_128_GCM_SHA256`), DDL/DML/queries over it; TLS 1.2 also negotiates; a certificate from the wrong CA is rejected. A 1.11.4 patch release follows, since 1.11.3 is out with the affected version.
Owner
|
@dependabot rebase |
…ates Bumps the cargo-patch group with 3 updates in the / directory: [clap](https://github.com/clap-rs/clap), [ureq](https://github.com/algesten/ureq) and [rustix](https://github.com/bytecodealliance/rustix). Updates `clap` from 4.6.6 to 4.6.7 - [Release notes](https://github.com/clap-rs/clap/releases) - [Changelog](https://github.com/clap-rs/clap/blob/main/CHANGELOG.md) - [Commits](clap-rs/clap@clap_complete-v4.6.6...clap_complete-v4.6.7) Updates `ureq` from 3.4.1 to 3.4.2 - [Changelog](https://github.com/algesten/ureq/blob/main/CHANGELOG.md) - [Commits](algesten/ureq@3.4.1...3.4.2) Updates `rustix` from 1.1.4 to 1.1.5 - [Release notes](https://github.com/bytecodealliance/rustix/releases) - [Changelog](https://github.com/bytecodealliance/rustix/blob/main/CHANGES.md) - [Commits](bytecodealliance/rustix@v1.1.4...v1.1.5) --- updated-dependencies: - dependency-name: clap dependency-version: 4.6.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-patch - dependency-name: rustix dependency-version: 1.1.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-patch - dependency-name: ureq dependency-version: 3.4.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/cargo/cargo-patch-e7461b4e31
branch
from
September 26, 2026 05:49
29bc79d to
cacfb05
Compare
Merged
kwhorne
added a commit
that referenced
this pull request
Sep 26, 2026
Release **1.11.4**, a security patch release. Bumps the version across `Cargo.toml`, `SERVER_VERSION`, both `Cargo.lock`s, the README and the docs, and dates the changelog section. Since 1.11.3: - **rustls 0.23.45 (RUSTSEC-2026-0285), #141.** rustls's TLS 1.3 handshake accepted handshake messages across encryption-level boundaries. The server terminates client TLS with rustls, and every release from 0.9.9 through 1.11.3 shipped an affected version. The advisory was published two days after 1.11.3, which is why its audit was green. - **Dependency patch bumps, #140:** clap 4.6.7, ureq 3.4.2, rustix 1.1.5. No other code change. See `CHANGELOG.md`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the cargo-patch group with 3 updates in the / directory: clap, ureq and rustix.
Updates
clapfrom 4.6.6 to 4.6.7Release notes
Sourced from clap's releases.
Changelog
Sourced from clap's changelog.
Commits
d3e59a9chore: Released997f87docs: Update changelogfb6058cMerge pull request #6409 from heaths/pwsh-support2310870test(complete): Add tests for completer_for_path5967c17refactor(complete): Move shell detection to Shells594602bfix(complete): Detect pwsh for PowerShell3a4f2d0Merge pull request #6427 from clap-rs/renovate/shlex-2.x67ebaedMerge pull request #6426 from clap-rs/renovate/actions-checkout-7.xc968b13chore(deps): Update Rust crate shlex to v28f247cbchore(deps): Update actions/checkout action to v7Updates
ureqfrom 3.4.1 to 3.4.2Changelog
Sourced from ureq's changelog.
Commits
2e9ef243.4.2b983841Bump ureq-proto to 0.6.3075a1d7Respect request connection settings when poolingfb634deTry the next resolved address when a connect fails for that address only (#1195)Updates
rustixfrom 1.1.4 to 1.1.5Commits
287214bchore: Release rustix version 1.1.50cea188fix(bug): ns->us overflow handling (#1655)a99fd26build: Remove OUT_DIR probe artifact (#1628)1e2954afix build errors for horizon target (#1671)4cecb72Mangle the name ofrustix::runtimeto discourage users. (#1633)ded795bFix compile errors for next libc version (#1676)9640071Expose theO_SYMLINK&O_NOFOLLOW_ANYflags on Apple platforms (#1666)cf67411Fix debug printing of abstract socket addrs (#1615)aab9464Completely removerustc_attrs. (#1663)a9620e8ci: fix syn pin (#1647)